PT-2022-24448 · Archery · Archery

Bit-Sec · Published 2022-09-13 · Updated 2022-10-06 · CVE-2022-38542

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Archery versions 1.4.0 through 1.8.5

Description The issue is related to a SQL injection vulnerability. It occurs via the ThreadIDs parameter in the "kill session" interface.

Recommendations For versions 1.4.0 through 1.8.5, upgrade to version 1.9.0 or above to resolve the issue. As a temporary workaround, consider restricting access to the kill session interface until the update is applied. Avoid using the ThreadIDs parameter in the affected interface until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-38542

Affected Products

Archery

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-38542 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38542 · Vendor Advisory
• https://github.com/hhyo/Archery/issues/1841 · Note
• https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L149 · Note
• https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6 · Note
• https://t.me/cibsecurity/49654 · Telegram Post
• https://t.me/cvenotify/36096 · Telegram Post