CVE-2023-50718

NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8	Exploit Vendor Advisory
https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*

History

26 Aug 2025, 18:52

Type	Values Removed	Values Added
First Time		Nocodb Nocodb nocodb
CPE	cpe:2.3:a:xgenecloud:nocodb::::::::	cpe:2.3:a:nocodb:nocodb::::::::

21 Aug 2025, 17:02

Type	Values Removed	Values Added
First Time		Xgenecloud Xgenecloud nocodb
CPE		cpe:2.3:a:xgenecloud:nocodb::::::::
References	~~() https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8 -~~	() https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8 - Exploit, Vendor Advisory

Information

Published : 2024-05-14 14:17

Updated : 2025-08-26 18:52

NVD link : CVE-2023-50718

Mitre link : CVE-2023-50718

CVE.ORG link : CVE-2023-50718

JSON object : View

Products Affected

nocodb

nocodb

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2023-50718", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-05-14T14:17:02.857", "references": [{"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue."}, {"lang": "es", "value": "NocoDB es un software para crear bases de datos como hojas de c\u00e1lculo. Antes de la versi\u00f3n 0.202.10, un atacante autenticado con acceso de creaci\u00f3n pod\u00eda realizar un ataque de inyecci\u00f3n SQL en una base de datos MySQL utilizando `table_name` sin escape. Esta vulnerabilidad puede provocar la fuga de datos confidenciales en la base de datos. La versi\u00f3n 0.202.10 contiene un parche para el problema."}], "lastModified": "2025-08-26T18:52:19.613", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF667F17-8608-4C7A-A2F3-FCDEE793BA53", "versionEndExcluding": "0.202.10"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}