Lucene search
HistoryAug 09, 2023 - 7:15 p.m.
CVE-2022-48595
sql injection
sciencelogic sl1
ticket template watchers
vulnerability
unsanitized input
sql query
arbitrary sql
database
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
31.7%
A SQL injection vulnerability exists in the “ticket template watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
Affected configurations
Node
sciencelogicsl1Range≤11.1.2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| sciencelogic | sl1 | * | cpe:2.3:a:sciencelogic:sl1:*:*:*:*:*:*:*:* |
Related
cnvd
cnvd
ScienceLogic SL1 SQL Injection Vulnerability (CNVD-2023-66424)
2023-08-12 00:00:00
cvelist
cvelist
CVE-2022-48595
2023-08-09 18:19:24
prion
prion
Sql injection
2023-08-09 19:15:00
cve
cve
CVE-2022-48595
2023-08-09 19:15:13
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
31.7%
Related for NVD:CVE-2022-48595