Security readout for executives and security teams
Plain-English summary
CVE-2015-10023 is a SQL injection issue in Fumon trello-octometric's metrics UI server code. A low-privileged user on an adjacent network could manipulate the num argument and affect database queries, potentially exposing, changing, or disrupting data. Public sources cite a patch, but do not list affected versions.
Executive priority
Treat as moderate priority unless this tool is exposed broadly or supports sensitive operational data. The business risk is database compromise through an application flaw, but available evidence indicates local network and low-privilege prerequisites rather than unauthenticated internet exposure.
Technical view
The issue is CWE-89 in metrics-ui/server/srv.go, function main, where the num argument can influence SQL query handling. CVSS 3.1 is 5.5 with adjacent-network access, low privileges, no user interaction, and limited confidentiality, integrity, and availability impact. The cited patch is commit a1f1754933fbf21e2221fbc671c81a47de6a04ef.
Likely exposure
Exposure appears limited to organizations running Fumon trello-octometric with the affected metrics UI server reachable from adjacent networks and accessible to low-privileged users. The source bundle does not identify exact affected versions or package identifiers.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation would require access consistent with the CVSS vector: adjacent network reachability and low privileges. Do not assume internet-wide exploitation from the provided evidence.
Researcher notes
Public evidence is sparse and affected versions are listed as n/a. VulDB describes the flaw as critical, while the supplied CVSS score is medium at 5.5. Analysis should center on the patched srv.go behavior and deployment reachability rather than unverified exploit claims.
Mitigation direction
- Apply the cited upstream patch commit where applicable.
- Check the project repository or vendor guidance for version-specific remediation.
- Restrict access to the metrics UI server to trusted administrative networks.
- Review database permissions used by the application and limit unnecessary privileges.
Validation and detection
- Inventory whether Fumon trello-octometric is deployed anywhere in the environment.
- Confirm whether metrics-ui/server/srv.go includes the cited patched change.
- Check whether the metrics UI is reachable beyond trusted adjacent networks.
- Review application logs for suspicious num parameter activity without reproducing exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2015-10023 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L2.13.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://vuldb.com/?id.217611CVE reference · vdb-entry, technical-description
- https://vuldb.com/?ctiid.217611CVE reference · signature, permissions-required
- https://github.com/Fumon/trello-octometric/commit/a1f1754933fbf21e2221fbc671c81a47de6a04efCVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.