Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-g8ha-yccg-p3f8

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.

Aliases

alias	CVE-2023-30848

alias	GHSA-6mhm-gcpf-5gr8

Fixed_packages

url	pkg:composer/pimcore/pimcore@10.5.21
purl	pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21

Affected_packages

References

reference_url	https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3
reference_id
reference_type
scores
url	https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3

reference_url	https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3.patch
reference_id
reference_type
scores
url	https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3.patch

reference_url	https://github.com/pimcore/pimcore/pull/14972
reference_id
reference_type
scores
url	https://github.com/pimcore/pimcore/pull/14972

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-30848
reference_id	CVE-2023-30848
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-30848

reference_url	https://github.com/advisories/GHSA-6mhm-gcpf-5gr8
reference_id	GHSA-6mhm-gcpf-5gr8
reference_type
scores
url	https://github.com/advisories/GHSA-6mhm-gcpf-5gr8

reference_url	https://github.com/pimcore/pimcore/security/advisories/GHSA-6mhm-gcpf-5gr8
reference_id	GHSA-6mhm-gcpf-5gr8
reference_type
scores
url	https://github.com/pimcore/pimcore/security/advisories/GHSA-6mhm-gcpf-5gr8

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	89
name	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description	The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g8ha-yccg-p3f8

Vulnerability Instance