CVE-2022-36120

Katalog CVE

CVSS 8.1 · High EPSS 1,0%

Kerentanan pada ssctech blue prism enterprise. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the getChartData administrative function. Using a low/no privilege Blue Prism user account, the attacker can alter the server's settings by abusing the getChartData method, allowing the Blue Prism server to execute any MSSQL stored procedure by name.

Rincian

Terbit di NVD

26 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blueprism.com product · advisory vendor
• https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise advisory vendor
• https://portal.blueprism.com/security-vulnerabilities-august-2022 permissions required · advisory vendor