CVE-2022-4422

Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in the version 3.0

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.usom.gov.tr/bildirim/tr-22-0747	Third Party Advisory
https://www.usom.gov.tr/bildirim/tr-22-0747	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bulutses:bulutdesk_callcenter:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:35

Type	Values Removed	Values Added
Summary		(es) Call Center System, desarrollado por Bulutses Information Technologies, en sus versiones anteriores a la 3.0 tiene una vulnerabilidad de inyección Sql no autenticada. Esto se ha solucionado en la versión 3.0.
References	~~() https://www.usom.gov.tr/bildirim/tr-22-0747 - Third Party Advisory~~	() https://www.usom.gov.tr/bildirim/tr-22-0747 - Third Party Advisory

Information

Published : 2023-01-10 14:15

Updated : 2024-11-21 07:35

NVD link : CVE-2022-4422

Mitre link : CVE-2022-4422

CVE.ORG link : CVE-2022-4422

JSON object : View

Products Affected

bulutses

bulutdesk_callcenter

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2022-4422", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "iletisim@usom.gov.tr", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-01-10T14:15:10.643", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-22-0747", "tags": ["Third Party Advisory"], "source": "iletisim@usom.gov.tr"}, {"url": "https://www.usom.gov.tr/bildirim/tr-22-0747", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "iletisim@usom.gov.tr", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in the version 3.0 \n\n"}, {"lang": "es", "value": "Call Center System, desarrollado por Bulutses Information Technologies, en sus versiones anteriores a la 3.0 tiene una vulnerabilidad de inyecci\u00f3n Sql no autenticada. Esto se ha solucionado en la versi\u00f3n 3.0."}], "lastModified": "2024-11-21T07:35:14.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bulutses:bulutdesk_callcenter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F488A1AE-F8A1-4F35-BB07-9B750AA15579", "versionEndExcluding": "3.0"}], "operator": "OR"}]}], "sourceIdentifier": "iletisim@usom.gov.tr"}