CVE-2021-43608

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.

Doctrine DBAL versiones 3.x anteriores a 3.1.4, permite una inyección de SQL. Es probable que el escape de las entradas de desplazamiento y longitud para la generación de una cláusula LIMIT no sea convertida en un número entero, permitiendo que se produzca una inyección SQL si los desarrolladores de aplicaciones pasan entradas de usuario sin escape al DBAL QueryBuilder o a cualquier otra API que use en última instancia la API AbstractPlatform::modifyLimitQuery

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-11-12 CVE Reserved
2021-12-09 CVE Published
2024-08-04 CVE Updated
2024-08-24 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CAPEC

References (4)

URL	Tag	Source
https://github.com/doctrine/dbal/releases	Release Notes
https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d	2021-12-15

URL	Date	SRC
https://www.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html	2021-12-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Doctrine-project Search vendor "Doctrine-project"		Database Abstraction Layer Search vendor "Doctrine-project" for product "Database Abstraction Layer"				>= 3.0.0 < 3.1.4 Search vendor "Doctrine-project" for product "Database Abstraction Layer" and version " >= 3.0.0 < 3.1.4"		-		Affected