exploitDog

CVE-2022-44014

Опубликовано: 25 дек. 2022

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks all user passwords and MSSQL hashes via /DS/LM_API/api/SelectionService/GetPaggedTab.

Ссылки

https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/
Exploit
Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:simmeth:lieferantenmanager:*:*:*:*:*:*:*:*

Версия до 5.6 (исключая)

EPSS

Процентиль: 56%

0.00337

Низкий

6.5 Medium

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-284

Связанные уязвимости

GHSA-9f66-rrvp-2m2v

CVSS3: 6.5

github

около 3 лет назад

An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks all user passwords and MSSQL hashes via /DS/LM_API/api/SelectionService/GetPaggedTab.

EPSS

Процентиль: 56%

0.00337

Низкий

6.5 Medium

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-284