Lucene search

TR-CERTCVELIST:CVE-2022-0495

HistorySep 21, 2022 - 8:45 a.m.

CVE-2022-0495 SQL Injection in KOHA

2022-09-2108:45:20

CWE-89

TR-CERT

www.cve.org

koha

sql injection

parantez teknoloji

CVSS3

9.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

AI Score

Confidence

High

EPSS

0.002

Percentile

51.5%

JSON

The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Parantez Teknoloji",
    "vendor": "Parantez Teknoloji",
    "versions": [
      {
        "lessThan": "19.05.03",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.usom.gov.tr/bildirim/tr-22-0635

CVSS3

9.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

AI Score

Confidence

High

EPSS

0.002

Percentile

51.5%

JSON

Related for CVELIST:CVE-2022-0495