x/vulndb: potential Go vuln in github.com/navidrome/navidrome: CVE-2022-23857

[GoVulnBot]

In CVE-2022-23857, the reference URL github.com/navidrome/navidrome (and possibly others) refers to something in Go.

• Commit: navidrome/navidrome@9e79b5c

module: github.com/navidrome/navidrome
package: n/a
description: |
    model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
cves:
  - CVE-2022-23857
links:
    commit: https://github.com/navidrome/navidrome/commit/9e79b5cbf2a48c1e4344df00fea4ed3844ea965d
    context:
      - https://github.com/navidrome/navidrome/releases/tag/v0.47.5

See doc/triage.md for instructions on how to triage this report.

[neild]

Vulnerability in tool.

[gopherbot]

Change https://go.dev/cl/592766 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607215 mentions this issue: data/reports: unexclude 20 reports (13)