CVE-2023-2681: An SQL Injection vulnerability has been found on Jorani version 1.0.0

This month

HIGH 8.8DOWNGRADE

CVE-2023-2681 is a high-severity flaw (CVSS 8.8) affecting jorani. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send queries with malicious SQL code on the "/leaves/validate" path and the “id” parameter, managing to extract arbritary information from the database.

Why this priority

High severity

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.8% (top 44%)
CISA exploited list	No
Weakness	CWE-89
Published	2023-10-03
Last modified	2026-06-17

Publisher (CNA): Spanish National Cybersecurity Institute, S.A. (INCIBE) · Vendor: jorani

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-10-03 13:15 UTCPublished CVE record published
2026-06-17 05:53 UTCUpdated Record last modified

jorani jorani DOWNGRADE

Affected: 1.0.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.0.0

1. Check installed version

apt-cache policy jorani || rpm -q jorani || jorani --version

2. No fixed release: DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)

apt-cache madison jorani sudo apt install jorani=<VERSION_BEFORE_1.0.0> sudo apt-mark hold jorani

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list jorani sudo dnf downgrade jorani-<VERSION_BEFORE_1.0.0> sudo dnf versionlock add jorani

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-2681?

jorani: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2023-2681 being exploited?

CVE-2023-2681 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-2681 affect?

CVE-2023-2681 affects jorani. Severity is high (CVSS 8.8). An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send queries with malicious SQL code on the "/leaves/validate" path and the “id” paramete

How urgent is CVE-2023-2681?

Priority 45/100. High severity

Related CVEs

CVE-2025-67102 HIGH 7.6 UPGRADE A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attack
CVE-2023-26469 CRITICAL 9.8 DOWNGRADE In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
CVE-2022-48118 MEDIUM 6.1 DOWNGRADE Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
CVE-2022-34134 HIGH 8.8 DOWNGRADE Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/contr
CVE-2022-34133 MEDIUM 6.1 DOWNGRADE Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at

References

← Back to latest CVEs