Authentication flaw

2022-10-2802:15:00

PRIOn knowledge base

www.prio-n.com

authentication

cevas

version 1.01.46

user input validation

sql queries

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.1%

JSON

All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.

CPENameOperatorVersion
cevaslt1.01.46

CPE	Name	Operator	Version
	cevas	lt	1.01.46

References

www.cisa.gov/uscert/ics/advisories/icsa-22-298-05

www.johnsoncontrols.com/cyber-solutions/security-advisories