CVSS 3.1 Score 9.8 of 10 (high)


Published Nov 4, 2023
Updated: Nov 13, 2023


CVE-2023-40922 is a critical SQL injection vulnerability discovered in kerawen before version 2.5.1. The vulnerability is present in the ocs_id_cart parameter of KerawenDeliveryModuleFrontController::initContent(). The exploitability score is 3.9, and the base severity is rated as critical with a score of 9.8 out of 10. The vulnerability does not require any privileges or user interaction and can be exploited over a network. It has a high impact on both integrity and confidentiality, with an availability impact also rated as high. The potential danger to organizations is significant, as it allows an attacker to inject malicious SQL commands and gain unauthorized access to sensitive data or perform unauthorized actions within the affected system. Organizations using kerawen should update to version 2.5.1 or newer to remediate this vulnerability and mitigate the risk it poses.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-40922 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options