{"answers":{"affected":"6 open source packages ship an affected version, including io.debezium:debezium-connector-mysql, io.debezium:debezium-connector-sqlserver and io.debezium:debezium-core.","exploited":"There is no known exploitation of CVE-2023-1419 in the wild and no public exploit code.","fix":"Upgrade io.debezium:debezium-connector-mysql to 2.3.0.Alpha1 or later.","what":"CVE-2023-1419 is a medium-severity code injection vulnerability in Red Hat Integration Change Data Capture, published on 17 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-1419 and fix it if it is affected.\n\nWhat it is: CVE-2023-1419 is a medium-severity code injection vulnerability in Red Hat Integration Change Data Capture, published on 17 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-1419 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- io.debezium:debezium-connector-mysql (Maven): affected all versions; fixed in 2.3.0.Alpha1\n- io.debezium:debezium-connector-mysql (Maven): affected all versions; fixed in 2.3.0.Alpha1\n- io.debezium:debezium-connector-sqlserver (Maven): affected all versions; fixed in 2.3.0.Alpha1\n- io.debezium:debezium-connector-sqlserver (Maven): affected all versions; fixed in 2.3.0.Alpha1\n- io.debezium:debezium-core (Maven): affected all versions; fixed in 2.3.0.Alpha1\n- io.debezium:debezium-core (Maven): affected all versions; fixed in 2.3.0.Alpha1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-1419/ (Markdown: https://insights.sbomify.com/CVE-2023-1419/index.md)","id":"CVE-2023-1419","markdown":"https://insights.sbomify.com/CVE-2023-1419/index.md","name":"CVE-2023-1419","record":{"aliases":["CLEANSTART-2026-XD56124","GHSA-hvw5-3mgw-7rcf"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Debezium database connector","requires_auth":"none","summary":"An attacker can inject malicious scripts via connector parameters in Debezium to view unauthorized data.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[],"cvss":{"score":5.9,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-233","name":"Improper Handling of Parameters"}],"description":"A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Debezium: script injection via connector parameter","id":"CVE-2023-1419","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"code_injection","year":"2023"},"n_packages":6,"n_references":2,"next":{"headline":"Ajax Search Lite \u003c 4.11.1, Pro \u003c 4.26.2 - Reflected Cross-Site Scripting","id":"CVE-2023-1420"},"packages":[{"ecosystem":"Maven","fixed":["2.3.0.Alpha1"],"introduced":["0"],"last_affected":[],"package":"io.debezium:debezium-connector-mysql","purl":null,"source":"GHSA-hvw5-3mgw-7rcf"},{"ecosystem":"Maven","fixed":["2.3.0.Alpha1"],"introduced":["0"],"last_affected":[],"package":"io.debezium:debezium-connector-mysql","purl":"pkg:maven/io.debezium/debezium-connector-mysql","source":"GHSA-hvw5-3mgw-7rcf"},{"ecosystem":"Maven","fixed":["2.3.0.Alpha1"],"introduced":["0"],"last_affected":[],"package":"io.debezium:debezium-connector-sqlserver","purl":null,"source":"GHSA-hvw5-3mgw-7rcf"},{"ecosystem":"Maven","fixed":["2.3.0.Alpha1"],"introduced":["0"],"last_affected":[],"package":"io.debezium:debezium-connector-sqlserver","purl":"pkg:maven/io.debezium/debezium-connector-sqlserver","source":"GHSA-hvw5-3mgw-7rcf"},{"ecosystem":"Maven","fixed":["2.3.0.Alpha1"],"introduced":["0"],"last_affected":[],"package":"io.debezium:debezium-core","purl":null,"source":"GHSA-hvw5-3mgw-7rcf"},{"ecosystem":"Maven","fixed":["2.3.0.Alpha1"],"introduced":["0"],"last_affected":[],"package":"io.debezium:debezium-core","purl":"pkg:maven/io.debezium/debezium-core","source":"GHSA-hvw5-3mgw-7rcf"}],"prev":{"headline":"SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter cashconfirm.php cross site scripting","id":"CVE-2023-1418"},"products":["Red Hat Integration Change Data Capture","Red Hat build of Debezium"],"published":"2024-11-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-11-18","vendors":["Red Hat"]},"summary":"An attacker can inject malicious scripts via connector parameters in Debezium to view unauthorized data.","url":"https://insights.sbomify.com/CVE-2023-1419/"}