CVE-2022-26651

Katalog CVE

CVSS 9.8 · Critical EPSS 7,0%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada digium asterisk, digium certified asterisk +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.

Rincian

Terbit di NVD

15 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

7,0% peluang dieksploitasi; lebih tinggi dari 94,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://downloads.asterisk.org/pub/security/ advisory vendor
• https://downloads.asterisk.org/pub/security/AST-2022-003.html advisory vendor
• http://packetstormsecurity.com/files/166746/Asterisk-Project-Security-Advisory-AST-2022-003.html advisory pihak ketiga · vdb entry
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5285 advisory pihak ketiga