GHSA-PMCR-2RHP-36HR中危已审查

SQL injection in github.com/navidrome/navidrome

OSV 1.4.0 · github-reviewed · 修改于 2022-01-26 05:03

发布时间

2022-01-28 00:23

GitHub 审查时间

2022-01-26 05:03

NVD 发布时间

2022-01-24 10:15

源文件

advisories/github-reviewed/2022/01/GHSA-pmcr-2rhp-36hr/GHSA-pmcr-2rhp-36hr.json

公告说明

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).

受影响的软件包

github.com/navidrome/navidrome

ECOSYSTEM

引入0修复0.47.5

标识信息

别名 / CVE

CVE-2022-23857

CWE

CWE-89

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-pmcr-2rhp-36hr",
  "aliases": [
    "CVE-2022-23857"
  ],
  "details": "model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).",
  "summary": "SQL injection in github.com/navidrome/navidrome",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.47.5"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/navidrome/navidrome",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2022-01-25T21:03:46Z",
  "severity": [],
  "published": "2022-01-27T16:23:02Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23857",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/navidrome/navidrome/commit/9e79b5cbf2a48c1e4344df00fea4ed3844ea965d",
      "type": "WEB"
    },
    {
      "url": "https://github.com/navidrome/navidrome",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/navidrome/navidrome/releases/tag/v0.47.5",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2022-01-24T02:15:00Z",
    "github_reviewed_at": "2022-01-25T21:03:46Z"
  }
}