CVE-2022-45165

EUVD-2022-48073
An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a user-controlled parameter that is used to create an SQL query. It causes this service to be prone to SQL injection.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
mitreCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
Affected Products (NVD)
VendorProductVersion
archibusweb_central
2022.03.01.107
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-45165
https://excellium-services.com/cert-xlm-advisory/CVE-2022-45165/
https://excellium-services.com/cert-xlm-advisory/CVE-2022-45165/