PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-2852 Softmed CVE debrief

CVE-2023-2852 is a critical SQL injection issue in Softmed SelfPatron affecting versions before 2.0. The CVE was published on 2023-07-10 and later modified on 2024-11-21. NVD classifies the issue as network-exploitable, with no privileges or user interaction required, and rates it 9.8/CRITICAL. For organizations that use SelfPatron, this should be treated as an urgent remediation item because a successful SQL injection can expose, alter, or disrupt application data.

Vendor
Softmed
Product
SelfPatron
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2023-07-10
Original CVE updated
2024-11-21
Advisory published
2023-07-10
Advisory updated
2024-11-21

Who should care

Administrators, application owners, and security teams responsible for Softmed SelfPatron deployments, especially any instance running a version before 2.0. Web application and vulnerability management teams should also review exposed instances and associated database connectivity.

Technical summary

NVD describes CVE-2023-2852 as an improper neutralization of special elements used in an SQL command (CWE-89) in Softmed SelfPatron. The affected version range is all versions before 2.0. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable issue with no authentication or user interaction required and high potential impact to confidentiality, integrity, and availability. A USOM advisory is referenced by NVD as supporting material.

Defensive priority

Urgent

Recommended defensive actions

  • Identify all Softmed SelfPatron deployments in your environment and confirm whether any instance is running a version earlier than 2.0.
  • Upgrade to SelfPatron 2.0 or later if that is the vendor-designated fixed version.
  • If immediate upgrading is not possible, restrict network access to the application and reduce exposure to trusted networks only.
  • Review application and database logs for unusual SQL query behavior or unexpected errors around SelfPatron endpoints.
  • Use the referenced advisory and official CVE/NVD records to validate remediation status and any vendor-specific guidance.

Evidence notes

The supplied NVD metadata lists CVE-2023-2852 as a SQL injection in Softmedyazilim SelfPatron, affecting versions before 2.0, with CWE-89 and CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD also references a USOM third-party advisory. No additional vendor patch bulletin or exploit details were included in the supplied corpus.

Official resources

Publicly disclosed on 2023-07-10 in the CVE/NVD record; later modified on 2024-11-21.