Lucene search

[email protected]CVE-2022-38118

HistoryAug 30, 2022 - 5:15 a.m.

CVE-2022-38118

2022-08-3005:15:08

CWE-89

[email protected]

web.nvd.nist.gov

cve-2022-38118

oaklouds portal

meeting room

sql injection

user input validation

remote attacker

security vulnerability

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.7%

JSON

OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform SQL-injection to access, modify, delete database, perform system operations and disrupt service.

Affected configurations

NVD

Node

hgigaoaklouds_portalRange2.0–2.0-163

hgigaoaklouds_portalRange3.0–3.0-163

CPENameOperatorVersion
hgiga:oaklouds_portalhgiga oaklouds portalle2.0-163
hgiga:oaklouds_portalhgiga oaklouds portalle3.0-163

CPE	Name	Operator	Version
hgiga:oaklouds_portal	hgiga oaklouds portal	le	2.0-163
hgiga:oaklouds_portal	hgiga oaklouds portal	le	3.0-163

CNA Affected

[
  {
    "platforms": [
      "OAKlouds-mol_metting-2.0"
    ],
    "product": "OAKlouds",
    "vendor": "HGiga",
    "versions": [
      {
        "lessThanOrEqual": "OAKlouds-mol_metting-2.0-163",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "OAKlouds-mol_metting-3.0"
    ],
    "product": "OAKlouds",
    "vendor": "HGiga",
    "versions": [
      {
        "lessThanOrEqual": "OAKlouds-mol_metting-3.0-163",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.chtsecurity.com/news/0a893178-5c64-4f1c-87f1-95cbf1e17c87

www.twcert.org.tw/tw/cp-132-6461-25c4b-1.html

Social References

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.7%

JSON

Related for CVE-2022-38118

prion1 nvd1 cvelist1