PT-2022-24168 · Ibax · Go-Ibax

Tomy · Published 2022-11-01 · Updated 2024-06-05 · CVE-2022-3798

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBAX go-ibax (affected versions not specified)

Description A critical vulnerability has been found in IBAX go-ibax, affecting an unknown function of the file "/api/v2/open/tablesInfo". The manipulation leads to SQL injection, and it is possible to launch the attack remotely. The exploit has been disclosed to the public.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Neutralization

SQL injection

Weakness Enumeration

CWE-707

CWE-89

Related Identifiers

CVE-2022-3798

GHSA-MGQH-3QM7-GX82

GO-2024-2777

Affected Products

Go-Ibax

References · 10

• https://osv.dev/vulnerability/CVE-2022-3798 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mgqh-3qm7-gx82 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3798 · Security Note
• https://osv.dev/vulnerability/GO-2024-2777 · Vendor Advisory
• https://github.com/IBAX-io/go-ibax/commit/b0183d8e550836dc50282ee74ff421ee41b25a37 · Note
• https://github.com/IBAX-io/go-ibax · Note
• https://github.com/IBAX-io/go-ibax/issues/2060 · Note
• https://vuldb.com/?id.212634 · Note
• https://t.me/cibsecurity/52393 · Telegram Post
• https://github.com/advisories/GHSA-mgqh-3qm7-gx82 · Note