{"action":"Upgrade egroupware/egroupware to 23.1.20240624 or later.","affected":[{"fixed":"23.1.20240624","introduced":"0"}],"component":"egroupware/egroupware","cve_ids":["CVE-2024-40614"],"ecosystem":"Packagist","epss":0.00678,"exploited":false,"fixed_versions":["23.1.20240624"],"ghsa_id":"GHSA-phg7-8mm9-gj88","id":"tcs_01M5KF6DEMN5CB4SFA988G44WM","modified_at":"2024-11-28T05:39:23.928893Z","published_at":"2024-07-07T15:31:12Z","references":["https://osv.dev/vulnerability/GHSA-phg7-8mm9-gj88","https://nvd.nist.gov/vuln/detail/CVE-2024-40614","https://github.com/EGroupware/egroupware/commit/553829d30cc2ccdc0e5a8c5a0e16fa03a3399a3f","https://github.com/EGroupware/egroupware","https://github.com/EGroupware/egroupware/compare/23.1.20240430...23.1.20240624","https://github.com/EGroupware/egroupware/releases/tag/23.1.20240624","https://help.egroupware.org/t/egroupware-maintenance-security-release-23-1-20240624/78438","https://syss.de","https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-047.txt","https://www.syss.de/pentest-blog/sql-injection-schwachstelle-in-egroupware-syss-2024-047"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-phg7-8mm9-gj88","url":"https://osv.dev/vulnerability/GHSA-phg7-8mm9-gj88"}],"summary":"EGroupware mishandles an ORDER BY clause"}