SQL Injection Vulnerability in TDuckCloud tduck-platform Product
CVE-2023-51805

6.5MEDIUM

Key Information:

Vendor

TDuckCloud

Status
tduck-platform
Vendor
CVE Published:
13 January 2024

What is CVE-2023-51805?

A SQL Injection vulnerability exists in the TDuckCloud tduck-platform version 4.0, allowing a remote attacker to exploit the getFormKey parameter within the search function of FormDataMysqlService.java. This flaw can lead to unauthorized access to sensitive information, highlighting the need for immediate attention to safeguard user data. It is crucial for users of this platform to apply security patches and follow best practices to mitigate the risks associated with such vulnerabilities.

References

https://github.com/TDuckCloud/tduck-platform/issues/22

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.