CVE-2022-24407

Katalog CVE

CVSS 8.8 · High EPSS 4,1%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada cyrusimap cyrus-sasl, debian linux +6 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

Rincian

Terbit di NVD

24 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

4,1% peluang dieksploitasi; lebih tinggi dari 90,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28 release notes · advisory vendor
• http://www.openwall.com/lists/oss-security/2022/02/23/4 mailing list · patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-note... release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/03/msg00002.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20221007-0003/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5087 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FIXU75Q6RBNK...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H26R4SMGM3WHX...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZC6BMPI3V3MC...