« Volver al listado

CVE-2023-46700

Estado: ModificadaCrítica (9.8)—

SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Luxsoft — Luxcal WEB Calendar

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-46700",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-46700",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-29T13:43:47.411906Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "LuxSoft",
          "product": "LuxCal Web Calendar",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.2.4M (MySQL version)"
            }
          ]
        },
        {
          "vendor": "LuxSoft",
          "product": "LuxCal Web Calendar",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.2.4L (SQLite version)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-11-20T05:15:08.823",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN15005948/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.luxsoft.eu/",
      "tags": [
        "Product"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.luxsoft.eu/?download",
      "tags": [
        "Release Notes"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.luxsoft.eu/lcforum/viewtopic.php?id=476",
      "tags": [
        "Issue Tracking"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN15005948/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.luxsoft.eu/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.luxsoft.eu/?download",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.luxsoft.eu/lcforum/viewtopic.php?id=476",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección SQL en LuxCal Web Calendar anterior a 5.2.4M (versión MySQL) y LuxCal Web Calendar anterior a 5.2.4L (versión SQLite) permite a un atacante remoto no autenticado ejecutar un comando SQL arbitrario enviando una solicitud manipulada y obtener o alterar información almacenada en la base de datos."
    }
  ],
  "lastModified": "2026-06-17T06:31:23.033",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:luxsoft:luxcal_web_calendar:*:*:*:*:sqlite:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A266C1B-1918-4316-8651-86EE836418ED",
              "versionEndExcluding": "5.2.4l"
            },
            {
              "criteria": "cpe:2.3:a:luxsoft:luxcal_web_calendar:*:*:*:*:mysql:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "666FC249-C711-437A-B205-9C9A1FE49E01",
              "versionEndExcluding": "5.2.4m"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}