CVE-2023-48645

{"id": "CVE-2023-48645", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-02-02T09:15:37.420", "references": [{"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2023-48645", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the Archibus app 4.0.3 for iOS. It uses a local database that is synchronized with a Web central server instance every time the application is opened, or when the refresh button is used. There is a SQL injection in the search work request feature in the Maintenance module of the app. This allows performing queries on the local database."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en la aplicaci\u00f3n Archibus 4.0.3 para iOS. Utiliza una base de datos local que se sincroniza con una instancia del servidor central web cada vez que se abre la aplicaci\u00f3n o cuando se utiliza el bot\u00f3n de actualizaci\u00f3n. Hay una inyecci\u00f3n de SQL en la funci\u00f3n de b\u00fasqueda de solicitudes de trabajo en el m\u00f3dulo de Mantenimiento de la aplicaci\u00f3n. Esto permite realizar consultas en la base de datos local."}], "lastModified": "2024-02-13T19:49:02.557", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eptura:archibus:4.0.3:*:*:*:iphone_os:*:*:*", "vulnerable": true, "matchCriteriaId": "9D2C0C7F-FDE0-4372-A750-16E68CAC7D73"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}