CVE-2023-7333: records-mover SQL Injection Vulnerability
Summary
CVE-2023-7333: records-mover Injection vulnerability. Affects records-mover versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'records-mover' package, developed by bluelabsio, is a tool designed for transferring records between various data sources and destinations. It provides a streamlined interface for handling data migrations, making it easier for developers to manage data flows in their applications. However, versions up to 1.5.4 are susceptible to a significant SQL Injection vulnerability, which can be exploited if an attacker has local access to the system.
Vulnerability Detail
A SQL Injection vulnerability exists in the 'records-mover' package, specifically within an unknown function of the Table Object Handler component. This weakness allows attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. The vulnerability requires local access to exploit, making it critical for developers to ensure that their systems are secure against unauthorized local users.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
pip install --upgrade "records-mover==1.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability other than upgrading to the patched version. It is advisable to restrict local access to the system where the application is deployed until the upgrade is completed.
Conclusion
The SQL Injection vulnerability identified as CVE-2023-7333 in the 'records-mover' package poses a risk to applications using versions up to 1.5.4. Developers are strongly encouraged to upgrade to version 1.6.0 to mitigate this risk and ensure the security of their data handling processes.
See every vulnerability recorded for records-mover →
FAQ
CVE-2023-7333 is a vulnerability identifier for a SQL Injection issue found in the 'records-mover' package, affecting versions up to 1.5.4.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring signup.
The SQL Injection vulnerability can lead to unauthorized access to data, data manipulation, and potentially compromise the integrity of the application.
Yes, upgrading to version 1.6.0 of the 'records-mover' package will patch the vulnerability.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
