CVE-2023-29047

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account. None No publicly available exploits are known.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Nov 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-290488.8A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged run CVE-2023-290496.1The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised CVE-2023-29058.8Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an CVE-2023-290509.6The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside CVE-2023-290518.1User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the CVE-2023-290525.4Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attack CVE-2023-290537.8A vulnerability has been identified in JT Open (All versions < V11.3.2.0), JT Utilities (All versions < V13.3.0.0). The affected application CVE-2023-290547.4A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE CVE-2023-290557.5In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that ma CVE-2023-290565.9A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must CVE-2023-290578.8A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to CVE-2023-290586.5A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message