Home > Vulnerability Database > CVE-2023-24163

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2023-24163

Good to know:

Date: January 30, 2023

SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.

Language: Java

Severity Score

9.8

Related Resources (8)

Url: https://gitee.com/dromara/hutool

Url: https://gitee.com/dromara/hutool/issues/I6AJWJ#note_20057806_link

Url: https://github.com/dromara/hutool/releases/tag/5.8.21

Url: https://github.com/google/osv.dev/issues/2195

Url: https://gitee.com/dromara/hutool/issues/I6AJWJ#note_15801868

Url: https://nvd.nist.gov/vuln/detail/CVE-2023-24163

Url: https://github.com/dromara/hutool/issues/3149

Url: https://www.mend.io/vulnerability-database/CVE-2023-24163

Severity Score

9.8

Weakness Type (CWE)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-89

Top Fix

Upgrade Version

Upgrade to version cn.hutool:hutool-all:5.8.21

CVSS v3.1

Base Score:	9.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us