Lucene search
HistoryDec 25, 2022 - 5:15 a.m.
CVE-2022-44014
simmeth lieferantenmanager
unauthorized access
sql tables
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
29.7%
An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks all user passwords and MSSQL hashes via /DS/LM_API/api/SelectionService/GetPaggedTab.
Affected configurations
Node
simmethlieferantenmanagerRange<5.6
Related
cve
cve
CVE-2022-44014
2022-12-25 05:15:10
prion
prion
Design/Logic Flaw
2022-12-25 05:15:00
cnvd
cnvd
Simmeth System Supplier Manager Design Error Vulnerability
2022-11-21 00:00:00
cvelist
cvelist
CVE-2022-44014
2022-12-25 00:00:00
zdt
zdt
packetstorm
packetstorm
Simmeth System GmbH Supplier Manager LFI / SQL Injection / Bypass
2022-11-15 00:00:00
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
29.7%
Related for NVD:CVE-2022-44014