Cyber Resilience

CVE-2023-40989

Critical

Published: 22 September 2023

Published
22 September 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.3866 97.3th percentile
Risk Priority 43 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-40989 is a critical-severity SQL Injection (CWE-89) vulnerability in Jeecg Jeecg Boot. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 2.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2023-40989 is a SQL injection vulnerability, tracked under CWE-89, that affects the jeecg-boot component of jeecgboot versions 3.0 and 3.5.3. The flaw resides in the report/jeecgboot/jmreport/queryFieldBySql endpoint and carries a CVSS 3.1 base score of 9.8.

An unauthenticated remote attacker can send a crafted request to the vulnerable endpoint and leverage the injection to execute arbitrary code, resulting in full compromise of confidentiality, integrity, and availability on the affected system.

Public references consist of GitHub repositories that appear to contain proof-of-concept material; no vendor advisory or patch information is supplied in the available references. The EPSS score reached a peak of 0.4283 with a current value of 0.3866, indicating moderate and relatively stable exploitation interest since disclosure.

EU & UK References

Vulnerability details

SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

jeecg
jeecg boot
3.0, 3.5.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References