CVE-2023-37196
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
CVE-2023-37196 describes an SQL Injection vulnerability that allows an authenticated user to access unauthorized content, change or delete content, or perform unauthorized actions by tampering with alert settings on DCE.
Risk Assessment
The organization may be exposed to unauthorized data access and the potential for data modification or deletion, which could lead to serious legal and reputational consequences.
Recommendation
It is recommended to conduct a security audit of the application and implement appropriate protections against SQL Injection attacks, including input validation and sanitization.
Other vulnerabilities in DCE
See all- CVE-2023-37199Medium
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored.
- CVE-2023-37198Medium
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages.
- CVE-2023-37197High
CVE-2023-37197 describes an SQL Injection vulnerability that allows an authenticated user to access unauthorized content, modify or delete content, or perform unauthorized actions by tampering with mass configuration settings of endpoints on DCE.
Original NVD description (English source)
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the alert settings of endpoints on DCE.