CVE-2022-23857

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists

published January 24, 2022

CVSS
—
EPSS
1%
Percentile
60.3
In the wild
Unconfirmed
What it is

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00932 · 60.3th percentile
Published
2022-01-24T01:56Z
EPSS history
Timeline
  • 24 JAN 01:56Z
    model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists
    cvelistv5