PT-2022-16254 · Unknown · Securegate

Published 2022-09-19 · Updated 2022-09-22 · CVE-2022-23767

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SecureGate (affected versions not specified)

Description The issue involves SQL-Injection using login without password and a path traversal vulnerability during file transfer. An attacker can exploit these to obtain privileges, execute remote code, and take over the victim's system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Path traversal

SQL injection

Weakness Enumeration

CWE-288

CWE-22

CWE-89

Related Identifiers

CVE-2022-23767

Affected Products

Securegate

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-23767 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23767 · Vendor Advisory
• https://t.me/cibsecurity/50095 · Telegram Post
• https://krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66926 · Note