CVE-2023-45162

Blind SQL vulnerability in 1E platform

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution.

Application of the relevant hotfix remediates this issue.

for v8.1.2 apply hotfix Q23166
for v8.4.1 apply hotfix Q23164
for v9.0.1 apply hotfix Q23169

SaaS implementations on v23.7.1 will automatically have hotfix Q23173 applied. Customers with SaaS versions below this are urged to upgrade urgently - please contact 1E to arrange this

Las versiones afectadas de 1E Platform tienen una vulnerabilidad de inyección Blind SQL que puede provocar la ejecución de código arbitrario. La aplicación del hotfix correspondiente soluciona este problema. para v8.1.2 aplique hotfix Q23166 para v8.4.1 aplique hotfix Q23164 para v9.0.1 aplique hotfix Q23169 Las implementaciones de SaaS en v23.7.1 tendrán automáticamente aplicado el hotfix Q23173. Se insta a los clientes con versiones de SaaS inferiores a esta a actualizar urgentemente; comuníquese con 1E para organizar esto.

*Credits: Discovered by 1E penetration testing

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2023-10-04 CVE Reserved
2023-10-13 CVE Published
2024-09-17 CVE Updated
2024-11-14 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CAPEC

CAPEC-108: Command Line Execution through SQL Injection

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.1e.com/trust-security-compliance/cve-info	2023-10-20

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
1e Search vendor "1e"		Platform Search vendor "1e" for product "Platform"				8.1.2 Search vendor "1e" for product "Platform" and version "8.1.2"		-		Affected
1e Search vendor "1e"		Platform Search vendor "1e" for product "Platform"				8.4.1 Search vendor "1e" for product "Platform" and version "8.4.1"		-		Affected
1e Search vendor "1e"		Platform Search vendor "1e" for product "Platform"				9.0.1 Search vendor "1e" for product "Platform" and version "9.0.1"		-		Affected
1e Search vendor "1e"		Platform Search vendor "1e" for product "Platform"				23.7.1 Search vendor "1e" for product "Platform" and version "23.7.1"		-		Affected