Read the docs
TI-2023-24473 Aliases CVE-2023-45674

SQL injection vulnerability in Farmbot-Web-App

Priority LOW 35CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Farmbot-Web-App is a web control interface for the Farmbot farm automation platform. An SQL injection vulnerability was found in FarmBot's web app that allows authenticated attackers to extract arbitrary data from its database (including the user table). This issue may lead to Information Disclosure. This issue has been patched in version 15.8.4. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00604 49th percentileScored 2026-11-07
Fix Fixed Farmbot-Web-App (FarmBot): 15.8.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FarmBotFarmbot-Web-Appbefore 15.8.415.8.4Patch availableCNA
  • Farmbot-Web-App VendorFarmBot Affected before 15.8.4 Fixed in 15.8.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:farmbot:farmbot_web_app:*:*:*:*:*:*:*:*before 15.8.4VulnerableFarmBot
  • cpe:2.3:a:farmbot:farmbot_web_app:*:*:*:*:*:*:*:* Versions before 15.8.4 Vulnerable ·FarmBot

Remediation

  • Fix · CNA Farmbot-Web-App (FarmBot) Fixed in 15.8.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45674

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences