CVE-2023-45826 - Vulnerability Details - OpenCVE

Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.1359.

Key SSVC decision points have not yet been added.

Vendors	Products
Leantime Subscribe	Leantime Subscribe

Configuration 1 [-]

OR	cpe:2.3:a:leantime:leantime::::::::
	cpe:2.3:a:leantime:leantime:2.4:-::::::
	cpe:2.3:a:leantime:leantime:2.4:beta::::::
	cpe:2.3:a:leantime:leantime:2.4:beta2::::::
	cpe:2.3:a:leantime:leantime:2.4:beta3::::::

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0
https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-10-19T18:28:54.167Z

Updated: 2024-09-12T17:51:49.888Z

Reserved: 2023-10-13T12:00:50.439Z

Link: CVE-2023-45826

Vulnrichment

Updated: 2024-08-02T20:29:32.545Z

NVD

Status : Modified

Published: 2023-10-19T19:15:16.133

Modified: 2024-11-21T08:27:26.227

Link: CVE-2023-45826

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-89

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-45826", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-10-13T12:00:50.439Z", "datePublished": "2023-10-19T18:28:54.167Z", "dateUpdated": "2024-09-12T17:51:49.888Z"}, "containers": {"cna": {"title": "Authenticated SQL Injection in leantime", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj"}, {"name": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0", "tags": ["x_refsource_MISC"], "url": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0"}], "affected": [{"vendor": "Leantime", "product": "leantime", "versions": [{"version": "< 2.4-beta-4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-19T18:28:54.167Z"}, "descriptions": [{"lang": "en", "value": "Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-559g-3h98-g3fj", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:29:32.545Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj"}, {"name": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-12T17:39:53.755092Z", "id": "CVE-2023-45826", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:51:49.888Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj", "name": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0", "name": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:29:32.545Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-45826", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-12T17:39:53.755092Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:51:44.130Z"}}], "cna": {"title": "Authenticated SQL Injection in leantime", "source": {"advisory": "GHSA-559g-3h98-g3fj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Leantime", "product": "leantime", "versions": [{"status": "affected", "version": "< 2.4-beta-4"}]}], "references": [{"url": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj", "name": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0", "name": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-19T18:28:54.167Z"}}}, "cveMetadata": {"cveId": "CVE-2023-45826", "state": "PUBLISHED", "dateUpdated": "2024-09-12T17:51:49.888Z", "dateReserved": "2023-10-13T12:00:50.439Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-10-19T18:28:54.167Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*", "matchCriteriaId": "B60921EA-E652-4FE2-9C25-F33F78A44EB4", "versionEndExcluding": "2.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:leantime:leantime:2.4:-:*:*:*:*:*:*", "matchCriteriaId": "22C7093F-E16C-4767-97A2-C403DEA9A6FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:leantime:leantime:2.4:beta:*:*:*:*:*:*", "matchCriteriaId": "A1592B9A-1F65-4533-A6BE-4B26F48E12D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:leantime:leantime:2.4:beta2:*:*:*:*:*:*", "matchCriteriaId": "6EE5A2E1-9AD9-482B-8FF1-9B72DE5E9349", "vulnerable": true}, {"criteria": "cpe:2.3:a:leantime:leantime:2.4:beta3:*:*:*:*:*:*", "matchCriteriaId": "B9E3DC96-3C78-40A3-8CA1-D631478597CF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Leantime es un sistema de gesti\u00f3n de proyectos de c\u00f3digo abierto. Una variable 'userId' en `app/domain/files/repositories/class.files.php` no est\u00e1 parametrizada. Un atacante autenticado puede enviar una solicitud POST cuidadosamente manipulada a `/api/jsonrpc` para explotar una vulnerabilidad de inyecci\u00f3n SQL. La confidencialidad se ve afectada ya que permite descargar informaci\u00f3n de la base de datos. Este problema se solucion\u00f3 en la versi\u00f3n 2.4-beta-4. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."}], "id": "CVE-2023-45826", "lastModified": "2024-11-21T08:27:26.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-19T19:15:16.133", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}