« Volver al listado

CVE-2023-4835

Estado: ModificadaCrítica (9.8)—

Neutralización inadecuada de Elementos Especiales utilizados en una vulnerabilidad de comando SQL ("Inyección SQL") en CF Software Oil Management Software permite la inyección SQL. Este problema afecta al Oil Management Software: antes de 20230912.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Petroleum Management Software Application Project — Petroleum Management Software Application

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-4835",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-4835",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-25T15:19:56.107815Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "iletisim@usom.gov.tr",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "iletisim@usom.gov.tr",
      "affectedData": [
        {
          "vendor": "CF Software",
          "product": "Oil Management Software",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "20230912",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-09-15T09:15:08.607",
  "references": [
    {
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0533",
      "source": "iletisim@usom.gov.tr"
    },
    {
      "url": "https://www.usom.gov.tr/bildirim/tr-23-0533",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "iletisim@usom.gov.tr"
    },
    {
      "url": "https://www.usom.gov.tr/bildirim/tr-23-0533",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "iletisim@usom.gov.tr",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CF Software Oil Management Software allows SQL Injection.\n\nThis issue affects Oil Management Software: before 20230912 ."
    },
    {
      "lang": "es",
      "value": "Neutralización inadecuada de Elementos Especiales utilizados en una vulnerabilidad de comando SQL (\"Inyección SQL\") en CF Software Oil Management Software permite la inyección SQL. Este problema afecta al Oil Management Software: antes de 20230912."
    }
  ],
  "lastModified": "2026-06-17T06:38:42.903",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:petroleum_management_software_application_project:petroleum_management_software_application:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4895F736-517B-41B3-8059-CC86D9F76397",
              "versionEndExcluding": "20230912"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "iletisim@usom.gov.tr"
}