exploitDog

CVE-2022-38488

Опубликовано: 14 дек. 2022

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.

Ссылки

https://archive.ph/PecmD
Third Party Advisory
https://archive.ph/VlGDa
Technical Description
Third Party Advisory
https://blog.logrocket.com/implement-oauth-2-0-node-js/
Product
Technical Description
Vendor Advisory
https://github.com/diogosouza/logrocket-oauth2-example
Broken Link
https://github.com/secoats/cve/tree/master/CVE-2022-38488_sqli_logrocket-oauth2-example
Exploit
Third Party Advisory
https://archive.ph/PecmD
Third Party Advisory
https://archive.ph/VlGDa
Technical Description
Third Party Advisory
https://blog.logrocket.com/implement-oauth-2-0-node-js/
Product
Technical Description
Vendor Advisory
https://github.com/diogosouza/logrocket-oauth2-example
Broken Link
https://github.com/secoats/cve/tree/master/CVE-2022-38488_sqli_logrocket-oauth2-example
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:logrocket-oauth2-example_project:logrocket-oauth2-example:*:*:*:*:*:*:*:*

Версия до 2020-05-27 (включая)

EPSS

Процентиль: 86%

0.02763

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89

CWE-89

Связанные уязвимости

GHSA-vv25-wjrq-fcv6

CVSS3: 9.8

github

около 3 лет назад

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.

EPSS

Процентиль: 86%

0.02763

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89

CWE-89