PT-2022-24170 · Ibax · Go-Ibax

Tomy · Published 2022-11-01 · Updated 2024-06-05 · CVE-2022-3800

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBAX go-ibax (affected versions not specified)

Description A critical issue has been found in IBAX go-ibax, affecting some unknown functionality of the file "/api/v2/open/rowsInfo". The manipulation of the table name argument leads to SQL injection. The attack can be launched remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Neutralization

SQL injection

Weakness Enumeration

CWE-707

CWE-89

Related Identifiers

CVE-2022-3800

GHSA-RWCF-GQ22-PH83

GO-2024-2783

Affected Products

Go-Ibax

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-3800 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3800 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rwcf-gq22-ph83 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2783 · Vendor Advisory
• https://github.com/IBAX-io/go-ibax/commit/b0183d8e550836dc50282ee74ff421ee41b25a37 · Note
• https://github.com/IBAX-io/go-ibax · Note
• https://github.com/IBAX-io/go-ibax/issues/2061 · Note
• https://github.com/advisories/GHSA-rwcf-gq22-ph83 · Note
• https://vuldb.com/?id.212636 · Note
• https://t.me/cibsecurity/52389 · Telegram Post