CVE-2023-46575

EUVD-2023-2939
A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
Affected Products (NVD)
VendorProductVersion
layer5meshery
𝑥
< 0.6.179
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/meshery/meshery/commit/ffe00967acfe4444a5db08ff3a4cafb9adf6013f
https://github.com/meshery/meshery/compare/v0.6.178...v0.6.179
https://github.com/meshery/meshery/pull/9372
https://meshery.io
https://github.com/meshery/meshery/commit/ffe00967acfe4444a5db08ff3a4cafb9adf6013f
https://github.com/meshery/meshery/compare/v0.6.178...v0.6.179
https://github.com/meshery/meshery/pull/9372
https://meshery.io