CVE-2024-43415

CVSS V2 None CVSS V3 None
Description
An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module <= v0.11.1 (> 0.9.0) allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands.
Overview
  • CVE ID
  • CVE-2024-43415
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-11-12T15:45:51.312Z
  • Last Modified Date
  • 2024-11-12T15:45:51.312Z
Weakness Enumerations
CWE URL
CWE-89 http://cwe.mitre.org/data/definitions/89.html
References
Reference URL Reference Tags
https://github.com/decidim-ice/decidim-module-decidim_awesome/security/advisories/GHSA-cxwf-qc32-375f x_refsource_CONFIRM
https://github.com/decidim-ice/decidim-module-decidim_awesome/commit/84374037d34a3ac80dc18406834169c65869f11b x_refsource_MISC
https://pentest.ait.ac.at/security-advisory/decidim-awesome-sql-injection-in-adminaccountability x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-43415
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43415
History
Created Old Value New Value Data Type Notes
2024-11-13 13:48:34 Added to TrackCVE