Lucene search

GoogleOSV:CVE-2022-4454

HistoryDec 13, 2022 - 6:15 p.m.

CVE-2022-4454

2022-12-1318:15:10

Google

osv.dev

cve-2022-4454

critical vulnerability

m0ver bible-online

search handler

sql injection

patch 6ef0aabfb2d4ccd53fcaa9707781303af357410e

vdb-215444

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

Low

EPSS

0.002

Percentile

55.5%

JSON

A vulnerability, which was classified as critical, has been found in m0ver bible-online. Affected by this issue is the function query of the file src/main/java/custom/application/search.java of the component Search Handler. The manipulation leads to sql injection. The name of the patch is 6ef0aabfb2d4ccd53fcaa9707781303af357410e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215444.

References

github.com/m0ver/bible-online/commit/6ef0aabfb2d4ccd53fcaa9707781303af357410e

vuldb.com/?id.215444

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

Low

EPSS

0.002

Percentile

55.5%

JSON

Related for OSV:CVE-2022-4454