Lucene search

MitreCVE-2022-37773

HistoryNov 23, 2022 - 12:15 a.m.

CVE-2022-37773

2022-11-2300:15:10

CWE-89

mitre

web.nvd.nist.gov

cve-2022-37773

authenticated sql injection

statistics page

maarch rm 2.8

filter parameter

database disclosure

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases.

Affected configurations

Nvd

Node

maarchmaarch_rmRange2.7–2.8.6

maarchmaarch_rmMatch2.9

VendorProductVersionCPE
maarchmaarch_rm*cpe:2.3:a:maarch:maarch_rm:*:*:*:*:*:*:*:*
maarchmaarch_rm2.9cpe:2.3:a:maarch:maarch_rm:2.9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
maarch	maarch_rm	*	cpe:2.3:a:maarch:maarch_rm::::::::
maarch	maarch_rm	2.9	cpe:2.3:a:maarch:maarch_rm:2.9:::::::*

References

maarch.com

github.com/frame84/vulns/blob/main/MaarchRM/CVE-2022-37773/README.md

Social References

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

Related for CVE-2022-37773