SQL injection in github.com/navidrome/navidrome

CVE-2022-23857 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).

Basic information

Type: reviewed
Severity: medium
Advisory on GitHub: Open advisory ↗
Repository advisory: —
Source code: Browse source ↗
Published (advisory): 2022-01-27 16:23:02 UTC
Updated: 2023-02-03 05:05:19 UTC
GitHub reviewed: 2022-01-25 21:03:46 UTC
NVD published: 2022-01-23

EPSS Score

Score	Percentile
0.29%	52.52%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type	Value
GHSA	GHSA-pmcr-2rhp-36hr ↗
CVE	CVE-2022-23857 ↗

CWEs

CWE id	Name
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
go	github.com/navidrome/navidrome	< 0.47.5	0.47.5	—

References

cvelogic Threat Intelligence