CVE-2022-24861

Remote Code Execution in Databasir

CVSS 9.9 CRITICALEPSS 2.8%CWE-20

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.9EPSS 2.8%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

20 Apr 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code execution vulnerability. JDBC drivers are not validated prior to use and may be provided by users of the system. This can lead to code execution by any basic user who has access to the system. Users are advised to upgrade. There are no known workarounds to this issue.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

vran-dev · databasir

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b https://github.com/vran-dev/databasir/pull/103 https://github.com/vran-dev/databasir/security/advisories/GHSA-5r2v-wcwh-7xmp