CVE-2023-40989
Published: 22 September 2023
Summary
CVE-2023-40989 is a critical-severity SQL Injection (CWE-89) vulnerability in Jeecg Jeecg Boot. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-40989 is a SQL injection vulnerability, tracked under CWE-89, that affects the jeecg-boot component of jeecgboot versions 3.0 and 3.5.3. The flaw resides in the report/jeecgboot/jmreport/queryFieldBySql endpoint and carries a CVSS 3.1 base score of 9.8.
An unauthenticated remote attacker can send a crafted request to the vulnerable endpoint and leverage the injection to execute arbitrary code, resulting in full compromise of confidentiality, integrity, and availability on the affected system.
Public references consist of GitHub repositories that appear to contain proof-of-concept material; no vendor advisory or patch information is supplied in the available references. The EPSS score reached a peak of 0.4283 with a current value of 0.3866, indicating moderate and relatively stable exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2591
Vulnerability details
SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.