What is GHSA-pmcr-2rhp-36hr?

GHSA-pmcr-2rhp-36hr is a security advisory published by GitHub Security Advisories with Medium severity. SQL injection in github.com/navidrome/navidrome

Which CVE IDs does GHSA-pmcr-2rhp-36hr cover?

GHSA-pmcr-2rhp-36hr covers the following CVE IDs: CVE-2022-23857. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-pmcr-2rhp-36hr?

GHSA-pmcr-2rhp-36hr affects 1 product, including: go/github.com/navidrome/navidrome:\u003c 0.47.5.

GHSA-pmcr-2rhp-36hrMedium

SQL injection in github.com/navidrome/navidrome

Vendor

GitHub Security Advisories

Published

January 27, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-23857 →

📋 Description

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).

🎯 Affected products1

go/github.com/navidrome/navidrome:< 0.47.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-23857
https://github.com/navidrome/navidrome/commit/9e79b5cbf2a48c1e4344df00fea4ed3844ea965d
https://github.com/navidrome/navidrome/releases/tag/v0.47.5
https://github.com/advisories/GHSA-pmcr-2rhp-36hr