PT-2023-13614 · Easyvista · Easyvista

CVE-2022-38490 · Publicado 2023-01-10 · Atualizado 2025-04-09

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N

Name of the Vulnerable Software and Affected Versions EasyVista versions 2020.2.125.3 through 2022.1.109.0.03

Description An issue was discovered that allows SQL injection through some parameters.

Recommendations For versions 2020.2.125.3 through 2022.1.109.0.03, update to version 2022.1.110.1.02 to correct the issue. As a temporary workaround, consider restricting access to parameters that allow SQL injection until a patch is available.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2022-38490

Produtos afetados

Easyvista

Referências · 7

• https://excellium-services.com/cert-xlm-advisory/CVE-2022-38490 · Nota
• https://osv.dev/vulnerability/CVE-2022-38490 · Aviso do Fabricante
• https://t.me/cibsecurity/56257 · Publicação no Telegram
• https://t.me/cvenotify/43088 · Publicação no Telegram
• https://t.me/cvenotify/118472 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-38490 · Nota de Segurança
• https://t.me/cvenotify/41967 · Publicação no Telegram