« Volver al listado

CVE-2023-1419

Estado: AplazadaMedia (5.9)—

A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Debezium — DebeziumAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-1419",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-1419",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-18T18:55:47.959448Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:debezium:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Debezium",
          "packageName": "mysql-connector-java",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:integration:1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Integration Change Data Capture",
          "packageName": "mysql-connector-java",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-17T11:15:05.593",
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2023-1419",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178722",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-233"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad de inyección de scripts en el conector de base de datos de Debezium, donde no se sanean correctamente algunos parámetros. Esta falla permite que un atacante envíe una solicitud maliciosa para inyectar un parámetro que puede permitir la visualización de datos no autorizados."
    }
  ],
  "lastModified": "2026-06-17T05:27:55.240",
  "sourceIdentifier": "secalert@redhat.com"
}