PT-2022-24886 · Ree6 · Ree6

Dxssucuk · Published 2022-10-13 · Updated 2022-10-17 · CVE-2022-39303

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ree6 versions prior to 1.7.0

Description This issue allows manipulation of SQL queries. The estimated number of potentially affected devices is not provided. There are no reported real-world incidents where this issue was exploited. The issue is related to SQL injection risk, which is mitigated by using Java's PreparedStatements.

Recommendations For versions prior to 1.7.0, update to version 1.7.0 to resolve the issue by utilizing Java's PreparedStatements, which allow object setting without the risk of SQL injection.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-39303

GHSA-69XV-XJFW-4PV8

Affected Products

Ree6

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39303.json · Exploit
• https://github.com/Ree6-Applications/Ree6/security/advisories/GHSA-69xv-xjfw-4pv8 · Patch
• https://osv.dev/vulnerability/CVE-2022-39303 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39303 · Security Note
• https://github.com/Ree6-Applications/Ree6/compare/1.6.4...1.7. · Note
• https://t.me/cibsecurity/51372 · Telegram Post