CVE-2022-3751CWE-89

SQL Injection in owncast/owncast

High · published November 29, 2022

CVSS v3.0
8.8
EPSS
1%
Percentile
61.9
In the wild
Unconfirmed
What it is

⚡ Surprise! An SQL injection vulnerability has been discovered in the owncast repository, affecting versions prior to 0.0.13! 🚨 Think of it like a restaurant where the chef prepares orders without checking the recipe — if an unscrupulous customer slips in a secret ingredient, the dish could turn out disastrous for anyone who eats it! An attacker could exploit this flaw to gain unauthorized access to the database, potentially allowing them to read, modify, or even delete data. This could lead to significant data breaches or loss of important information, making it a serious risk for any application using this version.

Put simply

Think of it like a restaurant where the chef prepares orders without checking the recipe — if an unscrupulous customer slips in a secret ingredient, the dish could turn out disastrous for anyone who eats it! This SQL injection vulnerability allows attackers to manipulate database queries through unvalidated user inputs, creating opportunities for unauthorized data access and manipulation.

What to do

An attacker could exploit this flaw to gain unauthorized access to the database, potentially allowing them to read, modify, or even delete data. This could lead to significant data breaches or loss of important information, making it a serious risk for any application using this version. Update the owncast repository to version 0.0.13 or later immediately to close this vulnerability. Additionally, validate and sanitize all user inputs to prevent any potential injections in the future. You've got this! By taking these steps, you'll enhance your security and keep your data safe! 🛡️

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00980 · 61.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-11-29T00:00Z
EPSS history
Timeline
  • 29 NOV 00:00Z
    SQL Injection in owncast/owncast
    cvelistv5