CVE-2023-50718 - Vulnerability Details - OpenCVE

NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Nocodb	Nocodb
Xgenecloud	Nocodb

Configuration 1 [-]

cpe:2.3:a:xgenecloud:nocodb:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8

History

Thu, 21 Aug 2025 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Xgenecloud Xgenecloud nocodb
CPEs		cpe:2.3:a:xgenecloud:nocodb::::::::
Vendors & Products		Xgenecloud Xgenecloud nocodb

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-05-13T16:08:09.198Z

Updated: 2024-08-21T20:46:16.025Z

Reserved: 2023-12-11T17:53:36.030Z

Link: CVE-2023-50718

Vulnrichment

Updated: 2024-08-02T22:16:47.369Z

NVD

Status : Analyzed

Published: 2024-05-14T14:17:02.857

Modified: 2025-08-21T17:02:08.693

Link: CVE-2023-50718

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-50718", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-12-11T17:53:36.030Z", "datePublished": "2024-05-13T16:08:09.198Z", "dateUpdated": "2024-08-21T20:46:16.025Z"}, "containers": {"cna": {"title": "NocoDB SQL Injection vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8"}], "affected": [{"vendor": "nocodb", "product": "nocodb", "versions": [{"version": "< 0.202.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-13T16:08:09.198Z"}, "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue."}], "source": {"advisory": "GHSA-8fxg-mr34-jqr8", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:47.369Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8"}]}, {"affected": [{"vendor": "nocodb", "product": "nocodb", "cpes": ["cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "0.202.10", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-13T20:17:19.969301Z", "id": "CVE-2023-50718", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T20:46:16.025Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8", "name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:47.369Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-50718", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-13T20:17:19.969301Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*"], "vendor": "nocodb", "product": "nocodb", "versions": [{"status": "affected", "version": "0", "lessThan": "0.202.10", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T20:46:10.863Z"}}], "cna": {"title": "NocoDB SQL Injection vulnerability", "source": {"advisory": "GHSA-8fxg-mr34-jqr8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nocodb", "product": "nocodb", "versions": [{"status": "affected", "version": "< 0.202.10"}]}], "references": [{"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8", "name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-13T16:08:09.198Z"}}}, "cveMetadata": {"cveId": "CVE-2023-50718", "state": "PUBLISHED", "dateUpdated": "2024-08-21T20:46:16.025Z", "dateReserved": "2023-12-11T17:53:36.030Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-05-13T16:08:09.198Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xgenecloud:nocodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF0AA92C-6ACF-428C-AEA1-E9813F8EC5B2", "versionEndExcluding": "0.202.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue."}, {"lang": "es", "value": "NocoDB es un software para crear bases de datos como hojas de c\u00e1lculo. Antes de la versi\u00f3n 0.202.10, un atacante autenticado con acceso de creaci\u00f3n pod\u00eda realizar un ataque de inyecci\u00f3n SQL en una base de datos MySQL utilizando `table_name` sin escape. Esta vulnerabilidad puede provocar la fuga de datos confidenciales en la base de datos. La versi\u00f3n 0.202.10 contiene un parche para el problema."}], "id": "CVE-2023-50718", "lastModified": "2025-08-21T17:02:08.693", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-05-14T14:17:02.857", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}