PT-2022-27113 · Boa · Boa

Yinfei6 · Published 2022-11-23 · Updated 2024-08-03 · CVE-2022-44117

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Boa version 0.94.14rc21

Description The issue concerns SQL Injection via the username variable. However, it is noted that this vulnerability is disputed by multiple third parties because Boa does not ship with any support for SQL.

Recommendations For Boa version 0.94.14rc21, as a temporary workaround, consider restricting the use of the username variable to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-44117

Affected Products

Boa

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-44117 · Security Note
• https://osv.dev/vulnerability/CVE-2022-44117 · Vendor Advisory
• https://t.me/cvenotify/38383 · Telegram Post
• https://t.me/cibsecurity/53457 · Telegram Post
• https://gist.github.com/yinfei6/20bd1d3ebe0803c2d8756ace3e173676 · Note
• https://t.me/cvenotify/73814 · Telegram Post
• https://t.me/cvenotify/88778 · Telegram Post