CVE-2023-39939
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
CVE-2023-39939 describes an SQL injection vulnerability in LuxCal Web Calendar prior to version 5.2.3M (MySQL version) and prior to version 5.2.3L (SQLite version). This allows a remote unauthenticated attacker to execute arbitrary queries against the database, potentially obtaining or altering information.
Risk Assessment
The risk to the organization includes unauthorized access to database information, which could lead to data disclosure or modification. An attacker could exploit this vulnerability to carry out further attacks on the system.
Recommendation
It is recommended to update LuxCal Web Calendar to version 5.2.3M or 5.2.3L to mitigate this vulnerability. Additionally, conducting a security audit of the database is advisable to identify potential threats.
Original NVD description (English source)
SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute arbitrary queries against the database and obtain or alter the information in it.