What is CVE-2023-43640?

CVE-2023-43640 is a medium-severity vulnerability in Speciesfilegroup Taxonworks, classified under SQL Injection. CVSS score: 6.5/10. Published 2023-09-22.

How severe is CVE-2023-43640?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SQL Injection in Speciesfilegroup Taxonworks

CVE-2023-43640

TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerability was found in TaxonWorks that allows authenticated attackers to extract arbitrary data from the TaxonWorks database (including the users table). This issue may lead to information disclosure. Version 0.34.0 contains a fix for the issue.

Vulnerability class: SQL Injection

EPSS: 0.005 (37.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Speciesfilegroup Taxonworks — versions < 0.34.0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-43640?: CVE-2023-43640 is a medium-severity vulnerability in Speciesfilegroup Taxonworks, classified under SQL Injection. CVSS score: 6.5/10. Published 2023-09-22.
How severe is CVE-2023-43640?: Medium severity. CVSS v3 base score is 6.5 out of 10.