[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f63w-AvVm1h7mOt70XyQyR0P94-J2a40ic-c9FLxdExk":3,"g5a-risk:CVE-2023-28424":118},{"success":4,"data":5,"meta":115},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":37,"epssPercentile":29,"epssTimeSeries":38,"severity":39,"affectedProducts":40,"affectedProductsCount":46,"references":47,"referencesCount":67,"weaknesses":68,"weaknessesCount":46,"isActivelyExploited":77,"cisaInfo":29,"otxData":29,"relatedBlogPosts":78,"seoMetadata":79,"configurations":104,"relatedVendorCves":113,"notableEvents":114},"CVE-2023-28424","What is CVE-2023-28424?","Soko if the code that powers packages.gentoo.org. Prior to version 1.0.2, the two package search handlers, `Search` and `SearchFeed`, implemented in `pkg\u002Fapp\u002Fhandler\u002Fpackages\u002Fsearch.go`, are affected by a SQL injection via the `q` parameter. As a result, unauthenticated attackers can execute arbitrary SQL queries on `https:\u002F\u002Fpackages.gentoo.org\u002F`. It was also demonstrated that primitive was enough to gain code execution in the context of the PostgreSQL container. The issue was addressed in commit `4fa6e4b619c0362728955b6ec56eab0e0cbf1e23y` of version 1.0.2 using prepared statements to interpolate user-controlled data in SQL queries.","Soko if the code that powers packages.gentoo.org. Prior to version 1.0.2, the two package search handlers, `Search` and `SearchFeed`, implemented in `pkg\u002Fapp...","2023-03-20T13:15:11.973","2025-04-11T14:50:48.42",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":29,"CVSSMetricV2":29,"CVSSMetricV40":29},[16,32],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":30,"ImpactScore":31},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":24,"IntegrityImpact":26,"AvailabilityImpact":26,"BaseScore":27,"BaseSeverity":28,"ExploitCodeMaturity":29,"RemediationLevel":29,"ReportConfidence":29,"TemporalScore":29,"TemporalSeverity":29,"ConfidentialityRequirement":29,"IntegrityRequirement":29,"AvailabilityRequirement":26,"ModifiedAttackVector":29,"ModifiedAttackComplexity":29,"ModifiedPrivilegesRequired":29,"ModifiedUserInteraction":29,"ModifiedScope":29,"ModifiedConfidentialityImpact":29,"ModifiedIntegrityImpact":29,"ModifiedAvailabilityImpact":29,"EnvironmentalScore":29,"EnvironmentalSeverity":29},"3.1","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H","NETWORK","LOW","NONE","UNCHANGED","HIGH",9.1,"CRITICAL",null,3.9,5.2,{"Source":33,"Type":34,"CVSSData":35,"ExploitabilityScore":30,"ImpactScore":36},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":26,"BaseScore":12,"BaseSeverity":28,"ExploitCodeMaturity":29,"RemediationLevel":29,"ReportConfidence":29,"TemporalScore":29,"TemporalSeverity":29,"ConfidentialityRequirement":29,"IntegrityRequirement":29,"AvailabilityRequirement":26,"ModifiedAttackVector":29,"ModifiedAttackComplexity":29,"ModifiedPrivilegesRequired":29,"ModifiedUserInteraction":29,"ModifiedScope":29,"ModifiedConfidentialityImpact":29,"ModifiedIntegrityImpact":29,"ModifiedAvailabilityImpact":29,"EnvironmentalScore":29,"EnvironmentalSeverity":29},5.9,0.0115,[37,37,37,37,37,37,37],"Critical",[41],{"vendor":42,"product":43,"version":44,"criteria":45,"vulnerable":4},"gentoo","soko","*","cpe:2.3:a:gentoo:soko:*:*:*:*:*:*:*:*",1,[48,53,58,63,65],{"url":49,"source":50,"tags":51},"https:\u002F\u002Fgithub.com\u002Fgentoo\u002Fsoko\u002Fsecurity\u002Fadvisories\u002FGHSA-gc2x-86p3-mxg2","GitHub",[52],"Vendor Advisory",{"url":54,"source":55,"tags":56},"https:\u002F\u002Fgitweb.gentoo.org\u002Fsites\u002Fsoko.git\u002Fcommit\u002F?id=4fa6e4b619c0362728955b6ec56eab0e0cbf1e23","Gentoo",[57],"Patch",{"url":59,"source":60,"tags":61},"https:\u002F\u002Fwww.sonarsource.com\u002Fblog\u002Fwhy-orms-and-prepared-statements-cant-always-win","Sonarsource",[62],"Technical Description",{"url":49,"source":50,"tags":64},[52],{"url":54,"source":55,"tags":66},[57],5,[69],{"id":70,"name":71,"description":72,"extendedDescription":73,"status":74,"abstraction":75,"structure":76},"CWE-89","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.","","Stable","Base","Simple",false,[],{"title":80,"metaDescription":81,"keywords":82,"canonicalUrl":83,"structuredData":84},"What is CVE-2023-28424? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2023-28424, a critical severity cyber security vulnerability from 2023. Soko if the code that powers packages.gentoo.org. Prior...","CVE-2023-28424, CVE-2023-28424 vulnerability, CVE-2023-28424 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2023, CVSS score, exploit, patch, remediation, gentoo security, soko vulnerability","\u002Fwhat-is\u002Fcve-2023-28424",{"@context":85,"@type":86,"headline":80,"description":81,"datePublished":10,"dateModified":11,"author":87,"publisher":91,"about":95,"mainEntityOfPage":99,"articleSection":102,"keywords":103},"https:\u002F\u002Fschema.org","TechArticle",{"@type":88,"name":89,"url":90},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":88,"name":89,"url":90,"logo":92},{"@type":93,"url":94},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":96,"name":6,"description":97,"additionalType":98},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":100,"@id":101},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2023-28424","Cybersecurity","CVE-2023-28424, CVE-2023-28424 vulnerability, CVE-2023-28424 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[105],{"Operator":29,"Negate":29,"Nodes":106},[107],{"Operator":108,"Negate":29,"CPEMatch":109},"OR",[110],{"Vulnerable":4,"Criteria":45,"MatchCriteriaID":111,"VersionStartExcluding":29,"VersionStartIncluding":29,"VersionEndExcluding":112,"VersionEndIncluding":29},"3683F486-233D-4B6C-9737-FBA83943FFB4","1.0.2",[],[],{"lastModified":11,"cacheTime":116,"version":117},1792356208384,"2.0",{"score":119,"band":120,"action":121,"scoredAt":122},54,"Medium","Plan remediation","2026-10-16T06:57:29.219716+00:00"]