Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2
CVE-2022-4259
8.8HIGH
What is CVE-2022-4259?
An SQL injection vulnerability exists in the Alerts controller of Nozomi Networks Guardian and CMC. This flaw arises from improper input validation, allowing authenticated attackers to execute arbitrary SQL queries against the underlying database management system (DBMS). Such unauthorized database access could lead to data leakage or manipulation, posing significant risks to the integrity and confidentiality of data stored within these applications.
Affected Version(s)
CMC 0 < 22.5.2
Guardian 0 < 22.5.2
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This issue was found by Stefano Libero of Nozomi Networks Product Security team during an internal code review