Lucene search
HistoryDec 25, 2022 - 4:15 a.m.
CVE-2022-45889
planet estream
database access
sql commands
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0.003
Percentile
68.0%
Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the database, and achieve the ability to execute arbitrary SQL commands, via Search (the StatisticsResults.aspx flt parameter).
Affected configurations
Node
planetestreamplanet_estreamRange<6.72.10.07
| Vendor | Product | Version | CPE |
|---|---|---|---|
| planetestream | planet_estream | * | cpe:2.3:a:planetestream:planet_estream:*:*:*:*:*:*:*:* |
Related
prion
prion
Sql injection
2022-12-25 04:15:00
cvelist
cvelist
CVE-2022-45889
2022-12-25 00:00:00
cve
cve
CVE-2022-45889
2022-12-25 04:15:07
packetstorm
packetstorm
Planet eStream Code Execution / SQL Injection / XSS / Broken Control
2022-12-09 00:00:00
zdt
zdt
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0.003
Percentile
68.0%
Related for NVD:CVE-2022-45889