CVE-2023-42268: 
Java vulnerability analysis and mitigation

Jeecg boot up to version 3.5.3 contains a SQL injection vulnerability that was discovered in the component /jeecg-boot/jmreport/show. The vulnerability was assigned CVE-2023-42268 and was first published on September 8, 2023. The affected software is Jeecg Boot, a popular enterprise application platform (NVD, CVE).

The vulnerability is classified as SQL Injection (CWE-89) and has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The high severity score indicates that the vulnerability requires no special privileges or user interaction to exploit, and can result in complete compromise of system confidentiality, integrity, and availability (NVD).

The SQL injection vulnerability allows attackers to potentially execute arbitrary SQL commands on the underlying database. Given the CVSS metrics, successful exploitation could lead to unauthorized access to sensitive data, manipulation of database contents, and potential system compromise (NVD).

Users should upgrade their Jeecg Boot installations to a version newer than 3.5.3 once a patch is available. As this is a recently disclosed vulnerability, users should monitor the official Jeecg Boot repository for security updates (Github Issue).