Upstream information

CVE-2023-5281 at MITRE

Description

A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as critical. This affects an unknown part of the file remove_inbox_message.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240909 was assigned to this vulnerability.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having critical severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 6.5
Vector AV:N/AC:L/Au:S/C:P/I:P/A:P
Access Vector Network
Access Complexity Low
Authentication Single
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
CVSS v3 Scores
  National Vulnerability Database
Base Score 9.8
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
CVSSv3 Version 3.1

Note from the SUSE Security Team on the kernel-default package

SUSE will no longer fix all CVEs in the Linux Kernel anymore, but declare some bug classes as won't fix. Please refer to TID 21496 for more details.

No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise High Availability Extension 12 SP5
  • cluster-md-kmp-default >= 4.12.14-122.222.1
  • dlm-kmp-default >= 4.12.14-122.222.1
  • gfs2-kmp-default >= 4.12.14-122.222.1
  • ocfs2-kmp-default >= 4.12.14-122.222.1
 Patchnames:
SUSE-SLE-HA-12-SP5-2024-2561
SUSE Linux Enterprise Live Patching 12 SP5
  • kernel-default-kgraft >= 4.12.14-122.222.1
  • kernel-default-kgraft-devel >= 4.12.14-122.222.1
 Patchnames:
SUSE-SLE-Live-Patching-12-SP5-2024-2561
SUSE Linux Enterprise Real Time 12 SP5
  • cluster-md-kmp-rt >= 4.12.14-10.191.1
  • dlm-kmp-rt >= 4.12.14-10.191.1
  • gfs2-kmp-rt >= 4.12.14-10.191.1
  • kernel-devel-rt >= 4.12.14-10.191.1
  • kernel-rt >= 4.12.14-10.191.1
  • kernel-rt-base >= 4.12.14-10.191.1
  • kernel-rt-devel >= 4.12.14-10.191.1
  • kernel-rt_debug >= 4.12.14-10.191.1
  • kernel-rt_debug-devel >= 4.12.14-10.191.1
  • kernel-source-rt >= 4.12.14-10.191.1
  • kernel-syms-rt >= 4.12.14-10.191.1
  • ocfs2-kmp-rt >= 4.12.14-10.191.1
 Patchnames:
SUSE-SLE-RT-12-SP5-2024-2381
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12 SP5
  • kernel-azure >= 4.12.14-16.191.1
  • kernel-azure-base >= 4.12.14-16.191.1
  • kernel-azure-devel >= 4.12.14-16.191.1
  • kernel-default >= 4.12.14-122.222.1
  • kernel-default-base >= 4.12.14-122.222.1
  • kernel-default-devel >= 4.12.14-122.222.1
  • kernel-default-extra >= 4.12.14-122.222.1
  • kernel-default-man >= 4.12.14-122.222.1
  • kernel-devel >= 4.12.14-122.222.1
  • kernel-devel-azure >= 4.12.14-16.191.1
  • kernel-docs >= 4.12.14-122.222.1
  • kernel-macros >= 4.12.14-122.222.1
  • kernel-obs-build >= 4.12.14-122.222.1
  • kernel-source >= 4.12.14-122.222.1
  • kernel-source-azure >= 4.12.14-16.191.1
  • kernel-syms >= 4.12.14-122.222.1
  • kernel-syms-azure >= 4.12.14-16.191.1
 Patchnames:
SUSE-SLE-SDK-12-SP5-2024-2561
SUSE-SLE-SERVER-12-SP5-2024-2360
SUSE-SLE-SERVER-12-SP5-2024-2561
SUSE-SLE-WE-12-SP5-2024-2561
SUSE Linux Enterprise Software Development Kit 12 SP5
  • kernel-docs >= 4.12.14-122.222.1
  • kernel-obs-build >= 4.12.14-122.222.1
 Patchnames:
SUSE-SLE-SDK-12-SP5-2024-2561
SUSE Linux Enterprise Workstation Extension 12 SP5
  • kernel-default-extra >= 4.12.14-122.222.1
 Patchnames:
SUSE-SLE-WE-12-SP5-2024-2561

SUSE Timeline for this CVE

CVE page created: Fri Sep 29 22:00:47 2023
CVE page last modified: Fri Jul 19 00:47:34 2024