CVE-2023-33967 - Vulnerability Details - OpenCVE

EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Megaease	Easeprobe

Configuration 1 [-]

cpe:2.3:a:megaease:easeprobe:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1
https://github.com/megaease/easeprobe/pull/330
https://github.com/megaease/easeprobe/releases/tag/v2.1.0
https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4

History

Thu, 09 Jan 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-05-31T17:18:38.317Z

Updated: 2025-01-09T18:39:23.791Z

Reserved: 2023-05-24T13:46:35.953Z

Link: CVE-2023-33967

Vulnrichment

Updated: 2024-08-02T15:54:14.183Z

NVD

Status : Modified

Published: 2023-05-31T18:15:09.603

Modified: 2024-11-21T08:06:18.770

Link: CVE-2023-33967

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-33967", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-05-24T13:46:35.953Z", "datePublished": "2023-05-31T17:18:38.317Z", "dateUpdated": "2025-01-09T18:39:23.791Z"}, "containers": {"cna": {"title": "EaseProbe vulnerable to SQL injection when using MySQL/PostgreSQL data checking", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4"}, {"name": "https://github.com/megaease/easeprobe/pull/330", "tags": ["x_refsource_MISC"], "url": "https://github.com/megaease/easeprobe/pull/330"}, {"name": "https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1", "tags": ["x_refsource_MISC"], "url": "https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1"}, {"name": "https://github.com/megaease/easeprobe/releases/tag/v2.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/megaease/easeprobe/releases/tag/v2.1.0"}], "affected": [{"vendor": "megaease", "product": "easeprobe", "versions": [{"version": "< 2.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-05-31T17:18:38.317Z"}, "descriptions": [{"lang": "en", "value": "EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0."}], "source": {"advisory": "GHSA-4c32-w6c7-77x4", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:54:14.183Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4"}, {"name": "https://github.com/megaease/easeprobe/pull/330", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/megaease/easeprobe/pull/330"}, {"name": "https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1"}, {"name": "https://github.com/megaease/easeprobe/releases/tag/v2.1.0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/megaease/easeprobe/releases/tag/v2.1.0"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-09T18:39:07.614763Z", "id": "CVE-2023-33967", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-09T18:39:23.791Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4", "name": "https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/megaease/easeprobe/pull/330", "name": "https://github.com/megaease/easeprobe/pull/330", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1", "name": "https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/megaease/easeprobe/releases/tag/v2.1.0", "name": "https://github.com/megaease/easeprobe/releases/tag/v2.1.0", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:54:14.183Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-33967", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-09T18:39:07.614763Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-09T18:39:13.957Z"}}], "cna": {"title": "EaseProbe vulnerable to SQL injection when using MySQL/PostgreSQL data checking", "source": {"advisory": "GHSA-4c32-w6c7-77x4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "megaease", "product": "easeprobe", "versions": [{"status": "affected", "version": "< 2.1.0"}]}], "references": [{"url": "https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4", "name": "https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/megaease/easeprobe/pull/330", "name": "https://github.com/megaease/easeprobe/pull/330", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1", "name": "https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/megaease/easeprobe/releases/tag/v2.1.0", "name": "https://github.com/megaease/easeprobe/releases/tag/v2.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-05-31T17:18:38.317Z"}}}, "cveMetadata": {"cveId": "CVE-2023-33967", "state": "PUBLISHED", "dateUpdated": "2025-01-09T18:39:23.791Z", "dateReserved": "2023-05-24T13:46:35.953Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-05-31T17:18:38.317Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:megaease:easeprobe:*:*:*:*:*:*:*:*", "matchCriteriaId": "80D94939-ED69-452D-BFAF-BDB67A4110BA", "versionEndExcluding": "2.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0."}], "id": "CVE-2023-33967", "lastModified": "2024-11-21T08:06:18.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-05-31T18:15:09.603", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/megaease/easeprobe/pull/330"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/megaease/easeprobe/releases/tag/v2.1.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/megaease/easeprobe/pull/330"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/megaease/easeprobe/releases/tag/v2.1.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}