CVE-2023-37197
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
CVE-2023-37197 describes an SQL Injection vulnerability that allows an authenticated user to access unauthorized content, modify or delete content, or perform unauthorized actions by tampering with mass configuration settings of endpoints on DCE.
Risk Assessment
The organization may be exposed to unauthorized data access and the potential for data modification or deletion, leading to serious legal and reputational consequences.
Recommendation
It is recommended to review and strengthen application security, including input validation and neutralization, to prevent SQL Injection attacks.
Other vulnerabilities in DCE
See all- CVE-2023-37199Medium
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored.
- CVE-2023-37198Medium
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages.
- CVE-2023-37196High
CVE-2023-37196 describes an SQL Injection vulnerability that allows an authenticated user to access unauthorized content, change or delete content, or perform unauthorized actions by tampering with alert settings on DCE.
Original NVD description (English source)
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the mass configuration settings of endpoints on DCE.