CVE-2022-30619CWE-89

Agile Point - Agile Point NX SQL injection (SQLi)

Medium · published July 6, 2022

CVSS v3.1
5.9
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

Editable SQL Queries behind Base64 encoding sending from the Client-Side to The Server-Side for a particular API used in legacy Work Center module. He attack is available for any authenticated user, in any kind of rule. under the function : /AgilePointServer/Extension/FetchUsingEncodedData in the parameter: EncodedData

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00759 · 54.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-07-06T13:12Z
EPSS history
Timeline
  • 06 JUL 13:12Z
    Agile Point - Agile Point NX SQL injection (SQLi)
    cvelistv5