Paper/Archive/CVE-2022-46764

CVE-2022-46764

TrueConf TrueConf Server — A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to exe…

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, CNA, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 83.5.835 × 2016.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution.

Affected

ProductAffectedFixed inSource

TrueConf Server5.2.0.102255.2.6.10025CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

mitre (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsolidlab.ru/our-news/145-trueconf.html refgithub.com/sldlb/public_cve_submissions/blob/main/CVE-2022-46764.txt refvuldb.com/?diff.216845