Vulnerability Description
A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the select parameter in models/base_client.py component.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Didotech | Engineering \& Lifecycle Management | >= 14.0, < 14.0.1.0.0 |
Related Weaknesses (CWE)
References
- https://github.com/luvsn/OdZoo/tree/main/exploits/pdm/2ExploitThird Party Advisory
- https://github.com/luvsn/OdZoo/tree/main/exploits/pdm/2ExploitThird Party Advisory
FAQ
What is CVE-2023-40955?
CVE-2023-40955 is a vulnerability with a CVSS score of 8.8 (HIGH). A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authent...
How severe is CVE-2023-40955?
CVE-2023-40955 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-40955?
Check the references section above for vendor advisories and patch information. Affected products include: Didotech Engineering \& Lifecycle Management.