PT-2022-14080 · Metasonic · Metasonic Doc Webclient

Joshua Martinelle · Published 2022-05-16 · Updated 2022-05-25 · CVE-2022-1731

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Metasonic Doc WebClient versions 7.0.3.0 through 7.0.14.0

Description The issue is related to a SQL injection attack in the username field. For the vulnerability to exist, either SSO or System authentication must be enabled.

Recommendations For Metasonic Doc WebClient versions 7.0.3.0 through 7.0.14.0, consider disabling the username field in the authentication process until a patch is available. Restrict access to the system when SSO or System authentication is enabled to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-1731

Affected Products

Metasonic Doc Webclient

References · 5

• 🔥 https://tenable.com/security/research/tra-2022-17 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1731 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1731 · Vendor Advisory
• https://t.me/cvenotify/30300 · Telegram Post
• https://t.me/cibsecurity/42767 · Telegram Post