Sign-up

ID

VAR-202208-0818


CVE

CVE-2022-38130


TITLE

Keysight Technologies  of  sensor management server  In  SQL  Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-014544

DESCRIPTION

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file (i.e., \\<attacker-host>\sms\<attacker-db.zip>), effectively controlling the content of the database to be restored. Keysight Technologies of sensor management server for, SQL There is an injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.71

sources: NVD: CVE-2022-38130 // JVNDB: JVNDB-2022-014544 // VULHUB: VHN-433970

AFFECTED PRODUCTS

vendor:keysightmodel:sensor management serverscope:eqversion:2.4.0

Trust: 1.8

vendor:keysightmodel:sensor management serverscope: - version: -

Trust: 0.8

vendor:keysightmodel:sensor management serverscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-014544 // NVD: CVE-2022-38130

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-38130
value: CRITICAL

Trust: 1.0

NVD: CVE-2022-38130
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202208-2742
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2022-38130
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-38130
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-014544 // CNNVD: CNNVD-202208-2742 // NVD: CVE-2022-38130

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.1

problemtype:SQL injection (CWE-89) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-433970 // JVNDB: JVNDB-2022-014544 // NVD: CVE-2022-38130

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202208-2742

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-202208-2742

PATCH

title:Keysight Technologies Sensor Management Server SQL Repair measures for injecting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=204381

Trust: 0.6

sources: CNNVD: CNNVD-202208-2742

EXTERNAL IDS

db:NVDid:CVE-2022-38130

Trust: 3.3

db:TENABLEid:TRA-2022-28

Trust: 2.5

db:JVNDBid:JVNDB-2022-014544

Trust: 0.8

db:CNNVDid:CNNVD-202208-2742

Trust: 0.6

db:VULHUBid:VHN-433970

Trust: 0.1

sources: VULHUB: VHN-433970 // JVNDB: JVNDB-2022-014544 // CNNVD: CNNVD-202208-2742 // NVD: CVE-2022-38130

REFERENCES

url:https://www.tenable.com/security/research/tra-2022-28

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-38130

Trust: 1.4

url:https://cxsecurity.com/cveshow/cve-2022-38130/

Trust: 0.6

sources: VULHUB: VHN-433970 // JVNDB: JVNDB-2022-014544 // CNNVD: CNNVD-202208-2742 // NVD: CVE-2022-38130

SOURCES

db:VULHUBid:VHN-433970
db:JVNDBid:JVNDB-2022-014544
db:CNNVDid:CNNVD-202208-2742
db:NVDid:CVE-2022-38130

LAST UPDATE DATE

2024-08-14T14:24:37.815000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-433970date:2022-08-15T00:00:00
db:JVNDBid:JVNDB-2022-014544date:2023-09-20T08:28:00
db:CNNVDid:CNNVD-202208-2742date:2022-08-16T00:00:00
db:NVDid:CVE-2022-38130date:2022-08-15T16:11:11.703

SOURCES RELEASE DATE

db:VULHUBid:VHN-433970date:2022-08-10T00:00:00
db:JVNDBid:JVNDB-2022-014544date:2023-09-20T00:00:00
db:CNNVDid:CNNVD-202208-2742date:2022-08-10T00:00:00
db:NVDid:CVE-2022-38130date:2022-08-10T20:16:06.777