CVE-2023-47003

Published: Nov 16, 2023Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted.

Affected (1)

Products: Redislabs: Redisgraph

Redislabs

1 product

Redisgraph

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redislabs Redisgraph	Version 2.12.10

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://github.com/RedisGraph/RedisGraph/issues/3063

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://github.com/RedisGraph/RedisGraph/issues/3063

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.