CVE-2023-47460
Published: 16 January 2024
Summary
CVE-2023-47460 is a high-severity SQL Injection (CWE-89) vulnerability in Knovos Discovery. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 5.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-47460 is a SQL injection vulnerability, tracked under CWE-89, that affects Knovos Discovery version 22.67.0. The flaw resides in the /DiscoveryProcess/Service/Admin.svc/getGridColumnStructure component and carries a CVSS 3.1 base score of 8.8.
An attacker with low-privileged network access can supply crafted input to the affected endpoint, enabling execution of arbitrary SQL commands that lead to full compromise of confidentiality, integrity, and availability on the server.
Public references consist of a proof-of-concept repository and the vendor site, but contain no published patches, workarounds, or official mitigation guidance. The associated EPSS score has remained flat at 0.1376 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-51572
Vulnerability details
SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/Service/Admin.svc/getGridColumnStructure component.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.