Home » Database

AVID-2026-R1242

Description

Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled (CVE-2023-32697)

Details

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

Reason for inclusion in AVID: CVE-2023-32697 describes remote code execution in sqlite-jdbc via attacker-controlled JDBC URL; sqlite-jdbc is a Java library used to access SQLite databases. Such libraries are commonly used in AI software stacks and data processing pipelines, making this a software supply chain risk for general-purpose AI systems. The vulnerability is a security issue with high impact, and the report provides CVE details and a fix version, giving sufficient evidence.

References

Affected or Relevant Artifacts

  • Developer: xerial
  • Deployer: xerial
  • Artifact Details:
TypeName
Systemsqlite-jdbc

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score8.8
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges Required🟢 Low
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-94CWE-94: Improper Control of Generation of Code (‘Code Injection’)

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2023-05-23
  • Version: 0.3.3
  • AVID Entry