IM
IronMonkey Threat Research

CVE-2022-24407 HIGH

Published: 2022-02-24 | Last Modified: 2024-11-21 | Status: Modified

Description

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

Additional Descriptions (1)

En Cyrus SASL versiones 2.1.17 hasta 2.1.27 anteriores a 2.1.28, el archivo plugins/sql.c no escapa la contraseña para una sentencia SQL INSERT o UPDATE

CVSS Metrics

Base Score: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 5.9

Base Score: 6.5 (MEDIUM)

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationSINGLE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 6.4

Weaknesses

Source Type Description
[email protected] Primary
en CWE-89

Affected Products

Vendor Product Version Update Type
cyrusimap cyrus-sasl * <built-in method update of dict object at 0x7fd2d3998ec0> Application
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd39c40a100> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd34088f5c0> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd2d3998840> Operating System
fedoraproject fedora 34 <built-in method update of dict object at 0x7fd369a4d8c0> Operating System
fedoraproject fedora 35 <built-in method update of dict object at 0x7fd34b9a7600> Operating System
fedoraproject fedora 36 <built-in method update of dict object at 0x7fd34b8dbac0> Operating System
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd340cc7a00> Application
netapp ontap_select_deploy_administration_utility - <built-in method update of dict object at 0x7fd39c409bc0> Application
oracle communications_cloud_native_core_console 22.2.0 <built-in method update of dict object at 0x7fd2dbd51500> Application
oracle communications_cloud_native_core_network_function_cloud_native_environment 22.2.0 <built-in method update of dict object at 0x7fd34088e5c0> Application
oracle communications_cloud_native_core_security_edge_protection_proxy 22.1.1 <built-in method update of dict object at 0x7fd340894080> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:cyrusimap:cyrus-sasl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Yes cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.2.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:*

References