CVE-2023-50718

{"id": "CVE-2023-50718", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-05-14T14:17:02.857", "references": [{"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue."}, {"lang": "es", "value": "NocoDB es un software para crear bases de datos como hojas de c\u00e1lculo. Antes de la versi\u00f3n 0.202.10, un atacante autenticado con acceso de creaci\u00f3n pod\u00eda realizar un ataque de inyecci\u00f3n SQL en una base de datos MySQL utilizando `table_name` sin escape. Esta vulnerabilidad puede provocar la fuga de datos confidenciales en la base de datos. La versi\u00f3n 0.202.10 contiene un parche para el problema."}], "lastModified": "2025-08-26T18:52:19.613", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF667F17-8608-4C7A-A2F3-FCDEE793BA53", "versionEndExcluding": "0.202.10"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}