Wiz
Vulnerability DatabaseCVE-2023-2681

CVE-2023-2681: 
Jorani vulnerability analysis and mitigation

Overview

An SQL Injection vulnerability (CVE-2023-2681) was discovered in Jorani version 1.0.0, a work absence management application. The vulnerability was discovered by David Utón Amaya and coordinated by INCIBE. The vulnerability was disclosed on May 29, 2023, and affects the application's leave validation functionality (INCIBE Advisory).

Technical details

The vulnerability is classified as CWE-89 (SQL Injection) and received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability specifically exists in the '/leaves/validate' path and the 'id' parameter, where malicious SQL code can be injected (INCIBE Advisory).

Impact

When successfully exploited, this vulnerability allows an authenticated remote user with low privileges to extract arbitrary information from the database, potentially compromising sensitive data and system integrity (INCIBE Advisory).

Mitigation and workarounds

The vulnerability has been patched in Jorani version 1.0.2, released on May 1st, 2023. Users are advised to upgrade to this version or later to mitigate the vulnerability (INCIBE Advisory).

Additional resources

Source: This report was generated using AI

Related Jorani vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2023-26469CRITICAL9.8
  • JoraniJorani
  • cpe:2.3:a:jorani:jorani
NoNoAug 17, 2023
CVE-2023-2681HIGH8.8
  • JoraniJorani
  • cpe:2.3:a:jorani:jorani
NoNoOct 03, 2023
CVE-2022-34134HIGH8.8
  • JoraniJorani
  • cpe:2.3:a:jorani:jorani
NoNoJun 28, 2022
CVE-2022-48118MEDIUM6.1
  • JoraniJorani
  • cpe:2.3:a:jorani_project:jorani
NoNoJan 27, 2023
CVE-2023-53870MEDIUM5.1
  • JoraniJorani
  • cpe:2.3:a:jorani:jorani
NoNoDec 15, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo