CVE-2022-41892CWE-89

Arches vulnerable to SQL Injection

High · published November 11, 2022

CVSS v3.1
8.6
EPSS
1%
Percentile
47.9
In the wild
Unconfirmed
What it is

Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in version 7.12, 6.2.1, and 6.1.2. Users are recommended to upgrade as soon as possible. There are no workarounds.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00598 · 47.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-11-11T00:00Z
EPSS history
Timeline
  • 11 NOV 00:00Z
    Arches vulnerable to SQL Injection
    cvelistv5