Critical severity · published Dec 9, 2021
CVE-2021-43608
Doctrine DBAL 3.x before 3.1.4 allows SQL Injection
9.8
CVSS
2.4%
EPSS
No
On KEV
Description
Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Database Abstraction Layer · Doctrine-project
3.0.0 before 3.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43608
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43608
Patch
https://github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d
Release Notes
https://github.com/doctrine/dbal/releases
Third Party Advisory
https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622
Vendor Advisory
https://www.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html