fkie_cve-2022-4259
Vulnerability from fkie_nvd
Published
2023-05-04 11:15
Modified
2024-11-21 07:34
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Due to improper input validation in the Alerts controller, a SQL injection vulnerability in Nozomi Networks Guardian and CMC allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application.
References
▼ | URL | Tags | |
---|---|---|---|
prodsec@nozominetworks.com | https://security.nozominetworks.com/NN-2023:1-01 | Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://security.nozominetworks.com/NN-2023:1-01 | Vendor Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
nozominetworks | cmc | * | |
nozominetworks | guardian | * |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:*", matchCriteriaId: "DDDB8DC9-6597-42D9-93C1-B4CCCEEBF124", versionEndExcluding: "22.5.2", vulnerable: true, }, { criteria: "cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*", matchCriteriaId: "AB906657-8A18-4D2E-8F9D-AC3CD4D9FC52", versionEndExcluding: "22.5.2", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Due to improper input validation in the Alerts controller, a SQL injection vulnerability in Nozomi Networks Guardian and CMC allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application.", }, ], id: "CVE-2022-4259", lastModified: "2024-11-21T07:34:53.517", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 5.9, source: "prodsec@nozominetworks.com", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], cvssMetricV40: [ { cvssData: { attackComplexity: "LOW", attackRequirements: "NONE", attackVector: "NETWORK", automatable: "NOT_DEFINED", availabilityRequirements: "NOT_DEFINED", baseScore: 8.7, baseSeverity: "HIGH", confidentialityRequirements: "NOT_DEFINED", exploitMaturity: "NOT_DEFINED", integrityRequirements: "NOT_DEFINED", modifiedAttackComplexity: "NOT_DEFINED", modifiedAttackRequirements: "NOT_DEFINED", modifiedAttackVector: "NOT_DEFINED", modifiedPrivilegesRequired: "NOT_DEFINED", modifiedSubsequentSystemAvailability: "NOT_DEFINED", modifiedSubsequentSystemConfidentiality: "NOT_DEFINED", modifiedSubsequentSystemIntegrity: "NOT_DEFINED", modifiedUserInteraction: "NOT_DEFINED", modifiedVulnerableSystemAvailability: "NOT_DEFINED", modifiedVulnerableSystemConfidentiality: "NOT_DEFINED", modifiedVulnerableSystemIntegrity: "NOT_DEFINED", privilegesRequired: "LOW", providerUrgency: "NOT_DEFINED", recovery: "NOT_DEFINED", safety: "NOT_DEFINED", subsequentSystemAvailability: "NONE", subsequentSystemConfidentiality: "NONE", subsequentSystemIntegrity: "NONE", userInteraction: "NONE", valueDensity: "NOT_DEFINED", vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", version: "4.0", vulnerabilityResponseEffort: "NOT_DEFINED", vulnerableSystemAvailability: "HIGH", vulnerableSystemConfidentiality: "HIGH", vulnerableSystemIntegrity: "HIGH", }, source: "prodsec@nozominetworks.com", type: "Secondary", }, ], }, published: "2023-05-04T11:15:08.930", references: [ { source: "prodsec@nozominetworks.com", tags: [ "Vendor Advisory", ], url: "https://security.nozominetworks.com/NN-2023:1-01", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://security.nozominetworks.com/NN-2023:1-01", }, ], sourceIdentifier: "prodsec@nozominetworks.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-89", }, ], source: "prodsec@nozominetworks.com", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-89", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.