PT-2024-11748 · Sparx Systems · Enterprise Architect

Maksymilian Kubiak + 1 · Published 2024-01-31 · Updated 2024-02-09 · CVE-2022-47072

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Enterprise Architect version 16.0.1605

Description The issue allows attackers to run arbitrary SQL commands via the Find parameter in the Select Classifier dialog box. This can be exploited by attackers to execute unauthorized SQL queries.

Recommendations For Enterprise Architect version 16.0.1605, consider restricting access to the Select Classifier dialog box until a patch is available. As a temporary workaround, avoid using the Find parameter in the affected dialog box to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-47072

Affected Products

Enterprise Architect

References · 7

• 🔥 https://github.com/DojoSecurity/Enterprise-Architect-SQL-Injection · Exploit
• https://osv.dev/vulnerability/CVE-2022-47072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47072 · Security Note
• https://t.me/cvenotify/69426 · Telegram Post
• https://t.me/cvenotify/70841 · Telegram Post
• https://t.me/cvenotify/69474 · Telegram Post
• https://twitter.com/CVEnew/status/1752805750056026422 · Twitter Post