CVE-2022-24407
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
In Cyrus SASL versions 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for SQL INSERT or UPDATE statements.
Risk Assessment
This could allow an attacker to perform SQL injection, leading to unauthorized database access or data modification.
Recommendation
Upgrade Cyrus SASL to version 2.1.28 or later.
Other vulnerabilities in Cyrus SASL
See all- CVE-2019-19906High
cyrus-sasl 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is caused by an off-by-one error in _sasl_add_string in common.c.
- CVE-2026-107161High
Heap-based buffer overflow in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin does not recompute buffer size after quoting, leading to out-of-bounds write. A malicious server can crash the client.
- CVE-2000-0956Medium
cyrus-sasl before version 1.5.24 in Red Hat Linux 7.0 does not properly verify the authorization for a local user, which could allow users to bypass specified access restrictions.
Original NVD description (English source)
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS