CVE-2023-25330

Description

MyBatis-Plus below 3.5.3.1 is vulnerable to SQL injection via the tenant ID value. This may allow remote attackers to execute arbitrary SQL commands.

How to fix CVE-2023-25330

To remediate CVE-2023-25330, upgrade the affected package to a fixed version below.

• Maven/com.baomidou:mybatis-plus—upgrade to 3.5.3.1 or later

Is CVE-2023-25330 being exploited?

Low — EPSS is 0.9%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 3.5.3.1

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-25330
• PATCHgithub.com/baomidou/mybatis-plus
• WEBbaomidou.com/reference/about-cve
• WEBgithub.com/FCncdn/MybatisPlusTenantPluginSQLInjection-POC/blob/master/Readme.en.md