SQL Injection

Critical

DxsSucuk published GHSA-69xv-xjfw-4pv8

Oct 12, 2022

Package

Ree6 (Maven)

Affected versions

<= 1.6.4

Patched versions

1.7.0 >=

Description

Impact

This Vulnerability allows manipulation of SQL queries.

Patches

This Problem has been patched in the version 1.7.0 by using Javas PreparedStatements, which allow object setting without the risk of SQL Injections.

Workarounds

There is none. Please update.

References

Here is the commit history between the version 1.6.4 and 1.7.0 : click

For more information

If you have any questions or comments about this advisory:

Open an issue on our GitHub Issue Site
Email us at security@ree6.de

Severity

Critical

9.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H