Paper/Archive/CVE-2022-24831

CVE-2022-24831

OpenClinica OpenClinica — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in OpenClinica

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 66.6.666 × 2013.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vulnerable to SQL injection due to the use of string concatenation to create SQL queries instead of prepared statements. No known workarounds exist. This issue has been patched in 3.16.1, 3.15.9, 3.14.1, and 3.13.1 and users are advised to upgrade.

Affected

ProductAffectedFixed inSource

OpenClinica< 3.13.1–CNA

OpenClinica>= 3.14, < 3.14.1–CNA

OpenClinica>= 3.15, < 3.15.9–CNA

OpenClinica>= 3.16, < 3.16.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

GitHub_M (CNA)8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/OpenClinica/OpenClinica/security/advisories/GHSA-5289-4jwp-xp9h refgithub.com/OpenClinica/OpenClinica/pull/3490/commits/b152cc63019230c9973965a98e4386ea5322c18f