CVE-2022-43842 : IBM Aspera Console 3.4.0 through 3.4.2 is vulnerable to SQL injection. A remote

IBM Aspera Console 3.4.0 through 3.4.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 239079.

Published 2024-02-23 19:15:08

Updated 2024-12-31 15:32:23

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: Sql Injection

Products affected by CVE-2022-43842

IBM » Aspera Console
Versions from including (>=) 3.4.0 and before (<) 3.4.2
cpe:2.3:a:ibm:aspera_console:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Aspera Console » Version: 3.4.2
cpe:2.3:a:ibm:aspera_console:3.4.2:-:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Aspera Console » Version: 3.4.2 Update Patch Level 4
cpe:2.3:a:ibm:aspera_console:3.4.2:patch_level_4:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Aspera Console » Version: 3.4.2 Update Patch Level 5
cpe:2.3:a:ibm:aspera_console:3.4.2:patch_level_5:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Aspera Console » Version: 3.4.2 Update Patch Level 2
cpe:2.3:a:ibm:aspera_console:3.4.2:patch_level_2:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Aspera Console » Version: 3.4.2 Update Patch Level 3
cpe:2.3:a:ibm:aspera_console:3.4.2:patch_level_3:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Aspera Console » Version: 3.4.2 Update Patch Level 1
cpe:2.3:a:ibm:aspera_console:3.4.2:patch_level_1:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Aspera Console » Version: 3.4.2 Update Patch Level 6
cpe:2.3:a:ibm:aspera_console:3.4.2:patch_level_6:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-43842

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 21 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-43842

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	3.9	5.2	NIST	2024-12-31
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None
8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L	3.9	4.7	IBM Corporation	2024-02-23
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: Low Availability: Low

CWE ids for CVE-2022-43842

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Assigned by: psirt@us.ibm.com (Secondary)

References for CVE-2022-43842

https://exchange.xforce.ibmcloud.com/vulnerabilities/239079

Vulnerability Report
Vendor Advisory
https://www.ibm.com/support/pages/node/7122632

Security Bulletin: IBM Aspera Console 3.4.2 PL7 has addressed a SQL injection vulnerability (CVE-2022-43842)
Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-43842

Products affected by CVE-2022-43842

Exploit prediction scoring system (EPSS) score for CVE-2022-43842

CVSS scores for CVE-2022-43842

CWE ids for CVE-2022-43842

References for CVE-2022-43842