CVE-2023-38992
Published: 28 July 2023
Summary
CVE-2023-38992 is a critical-severity SQL Injection (CWE-89) vulnerability in Jeecg Jeecg Boot. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
jeecg-boot version 3.5.1 contains a SQL injection vulnerability via the title parameter at the /sys/dict/loadTreeData endpoint. The issue is tracked as CVE-2023-38992, carries a CVSS 3.1 score of 9.8, and is categorized under CWE-89.
An unauthenticated attacker can send crafted requests over the network to the affected endpoint and obtain full read, write, and disruption capabilities on the underlying database and application data.
The associated GitHub issues provide the initial disclosure but contain no explicit patch or mitigation guidance in the supplied references. The EPSS score reached a peak of 0.6695 and currently stands at 0.6411.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2169
Vulnerability details
jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.