Lucene search
HistoryAug 09, 2023 - 7:15 p.m.
CVE-2022-48600
cve-2022-48600
sql injection
sciencelogic sl1
notes view
unsanitized input
user-controlled
database
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
31.7%
A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
Affected configurations
Node
sciencelogicsl1Range≤11.1.2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| sciencelogic | sl1 | * | cpe:2.3:a:sciencelogic:sl1:*:*:*:*:*:*:*:* |
Related
cve
cve
CVE-2022-48600
2023-08-09 19:15:13
prion
prion
Sql injection
2023-08-09 19:15:00
cnvd
cnvd
ScienceLogic SL1 SQL Injection Vulnerability (CNVD-2023-66416)
2023-08-12 00:00:00
cvelist
cvelist
CVE-2022-48600
2023-08-09 18:28:29
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
31.7%
Related for NVD:CVE-2022-48600