What is CVE-2023-41262?

CVE-2023-41262 is a critical-severity vulnerability in Plixer Scrutinizer, classified under SQL Injection. CVSS score: 9.8/10. Published 2023-10-12.

How severe is CVE-2023-41262?

Critical severity. CVSS v3 base score is 9.8 out of 10.

SQL Injection in Plixer Scrutinizer

CVE-2023-41262

An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL injection through the sorting parameter, allowing an unauthenticated user to execute arbitrary SQL statements in the context of the application's backend database server.

Vulnerability class: SQL Injection

EPSS: 0.007 (49.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Plixer Scrutinizer
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2023-41262?: CVE-2023-41262 is a critical-severity vulnerability in Plixer Scrutinizer, classified under SQL Injection. CVSS score: 9.8/10. Published 2023-10-12.
How severe is CVE-2023-41262?: Critical severity. CVSS v3 base score is 9.8 out of 10.