Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled · CVE-2023-32697 · GitHub Advisory Database · GitHub

Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled

High severity GitHub Reviewed Published May 23, 2023 in xerial/sqlite-jdbc • Updated Nov 7, 2023

Package

org.xerial:sqlite-jdbc (Maven)

Affected versions

>= 3.6.14.1, < 3.41.2.2

Patched versions

3.41.2.2

Description

Summary

Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL.

Impacted versions :

3.6.14.1-3.41.2.1

References

https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2

References

xerial published to xerial/sqlite-jdbc

May 23, 2023

Published to the GitHub Advisory Database May 23, 2023

Reviewed May 23, 2023

Published by the National Vulnerability Database

May 23, 2023

Last updated Nov 7, 2023

Severity

High

8.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H