THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2023-50718

NocoDB SQL Injection vulnerability

Reserved:2023-12-11
Published:2024-05-13
Updated:2024-05-13

Description

NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue.



MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

< 0.202.10
affected

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8

cve.org CVE-2023-50718

nvd.nist.gov CVE-2023-50718

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2023-50718