CVE-2022-24407CWE-89sql-injection

CVE-2022-24407

High · published February 24, 2022

CVSS v3.1
8.8
EPSS
4%
Percentile
90.8
In the wild
Unconfirmed
What it is

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04123 · 90.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-02-24T20:15Z
Affected products (12)
ProductVersionsFixed in
cyrusimap/cyrus-sasl≥ 2.1.17, ≤ 2.1.27—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
netapp/active_iq_unified_managerall versions—
netapp/ontap_select_deploy_administration_utilityall versions—
oracle/communications_cloud_native_core_consoleall versions—
oracle/communications_cloud_native_core_network_function_cloud_native_environmentall versions—
oracle/communications_cloud_native_core_security_edge_protection_proxyall versions—
References (21)
http://www.openwall.com/lists/oss-security/2022/02/23/4 · [email protected]https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst · [email protected]https://lists.debian.org/debian-lts-announce/2022/03/msg00002.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FIXU75Q6RBNK6UYM7MQ3TCFGXR7AX4U/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H26R4SMGM3WHXX4XYNNJB4YGFIL5UNF4/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZC6BMPI3V3MC2IGNLN377ETUWO7QBIH/ · [email protected]https://security.netapp.com/advisory/ntap-20221007-0003/ · [email protected]https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28 · [email protected]https://www.debian.org/security/2022/dsa-5087 · [email protected]https://www.oracle.com/security-alerts/cpujul2022.html · [email protected]http://www.openwall.com/lists/oss-security/2022/02/23/4 · af854a3a-2127-422b-91ae-364da2661108https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/03/msg00002.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FIXU75Q6RBNK6UYM7MQ3TCFGXR7AX4U/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H26R4SMGM3WHXX4XYNNJB4YGFIL5UNF4/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZC6BMPI3V3MC2IGNLN377ETUWO7QBIH/ · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20221007-0003/ · af854a3a-2127-422b-91ae-364da2661108https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28 · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5087 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2022.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 23 FEB 00:00Z
    In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement
    cvelistv5