« Volver al listado

CVE-2023-45826

Estado: ModificadaMedia (6.5)—💥 Exploit

Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Leantime — Leantime

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-45826",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-45826",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-12T17:39:53.755092Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Leantime",
          "product": "leantime",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.4-beta-4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-10-19T19:15:16.133",
  "references": [
    {
      "url": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Leantime/leantime/commit/be75f1e0f311d11c00a0bdc7079a62eef3594bf0",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-559g-3h98-g3fj",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "Leantime es un sistema de gestión de proyectos de código abierto. Una variable 'userId' en `app/domain/files/repositories/class.files.php` no está parametrizada. Un atacante autenticado puede enviar una solicitud POST cuidadosamente manipulada a `/api/jsonrpc` para explotar una vulnerabilidad de inyección SQL. La confidencialidad se ve afectada ya que permite descargar información de la base de datos. Este problema se solucionó en la versión 2.4-beta-4. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T06:29:36.320",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B60921EA-E652-4FE2-9C25-F33F78A44EB4",
              "versionEndExcluding": "2.4"
            },
            {
              "criteria": "cpe:2.3:a:leantime:leantime:2.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22C7093F-E16C-4767-97A2-C403DEA9A6FD"
            },
            {
              "criteria": "cpe:2.3:a:leantime:leantime:2.4:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1592B9A-1F65-4533-A6BE-4B26F48E12D6"
            },
            {
              "criteria": "cpe:2.3:a:leantime:leantime:2.4:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6EE5A2E1-9AD9-482B-8FF1-9B72DE5E9349"
            },
            {
              "criteria": "cpe:2.3:a:leantime:leantime:2.4:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9E3DC96-3C78-40A3-8CA1-D631478597CF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}