CVE-2023-43640CWE-89

TaxonWorks SQL injection vulnerability

Medium · published September 22, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
45.0
In the wild
Unconfirmed
What it is

TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerability was found in TaxonWorks that allows authenticated attackers to extract arbitrary data from the TaxonWorks database (including the users table). This issue may lead to information disclosure. Version 0.34.0 contains a fix for the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00547 · 45.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-09-22T17:11Z
EPSS history
Timeline
  • 22 SEP 17:11Z
    TaxonWorks SQL injection vulnerability
    cvelistv5