CVE-2023-45826

Medium

Published: 19 October 2023

Published

19 October 2023

Modified

21 November 2024

KEV Added

—

Patch

—

CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.3441 97.1th percentile

Risk Priority 34 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-45826 is a medium-severity SQL Injection (CWE-89) vulnerability in Leantime Leantime. Its CVSS base score is 6.5 (Medium).

Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

Leantime is an open source project management system affected by an SQL injection vulnerability tracked as CVE-2023-45826. The flaw stems from an unparameterized userId variable in app/domain/files/repositories/class.files.php, which fails to properly sanitize input before constructing database queries. The issue carries a CVSS 3.1 score of 6.5 and is classified under CWE-89.

An authenticated attacker can exploit the weakness by sending a crafted POST request to the /api/jsonrpc endpoint. Successful exploitation allows the attacker to dump arbitrary information from the database, impacting confidentiality while leaving integrity and availability unaffected.

The vulnerability was addressed in Leantime version 2.4-beta-4 via a commit that parameterizes the affected query. The project’s GitHub Security Advisory GHSA-559g-3h98-g3fj states that users should upgrade and notes that no workarounds are available.

The associated EPSS score has remained flat at 0.3441 with no material increase after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-50097

Vulnerability details

Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows…

for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.