CVE-2023-43640

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-43640

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-43640.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-43640

Aliases

GHSA-m9p2-jxr6-4p6c

Published

2023-09-22T17:11:42.290Z

Modified

2025-12-05T00:07:25.268881Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

TaxonWorks SQL injection vulnerability

Details

TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerability was found in TaxonWorks that allows authenticated attackers to extract arbitrary data from the TaxonWorks database (including the users table). This issue may lead to information disclosure. Version 0.34.0 contains a fix for the issue.

Database specific

{
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43640.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/speciesfilegroup/taxonworks

Affected ranges

Type: GIT
Repo: https://github.com/speciesfilegroup/taxonworks
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

f7afd08dcb2493564e4d19dc3fa61d1b5f790b49

Affected versions

Other

burlap

canvas

v0.*

v0.0.1

v0.0.10

v0.0.2

v0.0.3

v0.0.4

v0.0.5

v0.0.6

v0.0.8

v0.0.9

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.10.8

v0.10.9

v0.11.0

v0.12.0

v0.12.1

v0.12.10

v0.12.11

v0.12.12

v0.12.13

v0.12.14

v0.12.15

v0.12.16

v0.12.17

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.12.6

v0.12.7

v0.12.8

v0.12.9

v0.13.0

v0.14.0

v0.14.1

v0.15.0

v0.15.1

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.16.4

v0.16.5

v0.16.6

v0.17.0

v0.17.1

v0.18.0

v0.18.1

v0.19.0

v0.19.1

v0.19.2

v0.19.3

v0.19.4

v0.19.5

v0.19.6

v0.19.7

v0.2.0

v0.2.1

v0.2.10

v0.2.11

v0.2.15

v0.2.17

v0.2.18

v0.2.19

v0.2.2

v0.2.20

v0.2.21

v0.2.22

v0.2.23

v0.2.24

v0.2.25

v0.2.26

v0.2.27

v0.2.28

v0.2.29

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.8

v0.2.9

v0.20.0

v0.20.1

v0.21.0

v0.21.1

v0.21.2

v0.21.3

v0.22.0

v0.22.1

v0.22.2

v0.22.3

v0.22.4

v0.22.5

v0.22.6

v0.22.7

v0.23.0

v0.23.1

v0.24.0

v0.24.1

v0.24.2

v0.24.3

v0.24.4

v0.24.5

v0.25.0

v0.26.0

v0.26.1

v0.26.2

v0.27.0

v0.27.1

v0.27.2

v0.27.3

v0.28.0

v0.28.1

v0.29.0

v0.29.1

v0.29.2

v0.29.3

v0.29.4

v0.29.5

v0.29.6

v0.3.0

v0.3.1

v0.3.11

v0.3.12

v0.3.13

v0.3.14

v0.3.15

v0.3.16

v0.3.2

v0.3.3

v0.3.4

v0.3.6

v0.3.7

v0.3.9

v0.30.0

v0.30.1

v0.30.2

v0.30.3

v0.31.0

v0.31.1

v0.31.2

v0.31.3

v0.32.0

v0.32.1

v0.32.2

v0.32.3

v0.33.0

v0.33.1

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-43640.json"