CVE-2022-2315 - OpenCVE

Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Databank	Accreditation Tracking\/presentation Module

Configuration 1 [-]

cpe:2.3:a:databank:accreditation_tracking\/presentation_module:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.usom.gov.tr/bildirim/tr-22-0634

History

Mon, 16 Sep 2024 21:00:00 +0000

Type	Values Removed	Values Added
Description	Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.	Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2022-09-21T07:50:09.721004Z

Updated: 2024-09-16T20:47:19.074Z

Reserved: 2022-07-05T00:00:00

Link: CVE-2022-2315

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-09-21T08:15:08.807

Modified: 2024-09-16T21:15:43.870

Link: CVE-2022-2315

Redhat

No data.

{"containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Database Software", "vendor": "Database Software", "versions": [{"lessThan": "2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Bartu Utku Sarp"}], "datePublic": "2022-09-20T21:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.</p>"}], "value": "Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2023-09-03T15:45:21.980Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.usom.gov.tr/bildirim/tr-22-0634"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Database Software Accreditation Tracking/Presentation Module should be updated to the v2 version provided by the vendor. </p>"}], "value": "Database Software Accreditation Tracking/Presentation Module should be updated to the v2 version provided by the vendor."}], "source": {"advisory": "TR-22-0634", "defect": ["TR-22-0634"], "discovery": "EXTERNAL"}, "title": "SQL Injection in Database Accreditation System", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@usom.gov.tr", "DATE_PUBLIC": "2022-09-21T15:00:00.000Z", "ID": "CVE-2022-2315", "STATE": "PUBLIC", "TITLE": "SQL Injection in Database Accreditation System"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Database Software", "version": {"version_data": [{"version_affected": "<", "version_value": "2"}]}}]}, "vendor_name": "Database Software"}]}}, "credit": [{"lang": "eng", "value": "Bartu Utku Sarp"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89 SQL Injection"}]}]}, "references": {"reference_data": [{"name": "https://www.usom.gov.tr/bildirim/tr-22-0634", "refsource": "CONFIRM", "url": "https://www.usom.gov.tr/bildirim/tr-22-0634"}]}, "solution": [{"lang": "en", "value": "Database Software Accreditation Tracking/Presentation Module should be updated to the v2 version provided by the vendor."}], "source": {"advisory": "TR-22-0634", "defect": ["TR-22-0634"], "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:32:09.580Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.usom.gov.tr/bildirim/tr-22-0634"}]}]}, "cveMetadata": {"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "assignerShortName": "TR-CERT", "cveId": "CVE-2022-2315", "datePublished": "2022-09-21T07:50:09.721004Z", "dateReserved": "2022-07-05T00:00:00", "dateUpdated": "2024-09-16T20:47:19.074Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}