SQL Injection Vulnerability in OSS Calendar by OSS
CVE-2023-47609

8.8HIGH

Key Information:

Vendor: Thinkingreed Inc.
Status: OSS Calendar
Vendor: CVE Published:; 14 November 2023

🔔 Create Thinkingreed Inc. Vulnerability Alert

What is CVE-2023-47609?

An SQL injection vulnerability in OSS Calendar versions before 2.0.3 allows remote authenticated attackers to execute arbitrary code or manipulate data stored in the database by crafting specific requests. This flaw can lead to unauthorized access and alteration of sensitive information, highlighting the need for immediate updates to the affected versions.

Affected Version(s)

OSS Calendar prior to v.2.0.3

References

https://oss-calendar.com/news/20231113/

https://jvn.jp/en/jp/JVN67822421/

CVSS V3.1

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 14, 2023
Vulnerability Reserved
Nov 7, 2023

CVE-2023-47609 Data

JSON