CVE-2022-38615
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
SmartVista SVFE2 v2.2.22 was found to contain multiple SQL injection vulnerabilities in the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf. An attacker can exploit these flaws to manipulate database queries.
Risk Assessment
The risk includes unauthorized access, modification, or deletion of data, potentially leading to confidentiality and integrity breaches and exposure of sensitive information.
Recommendation
Immediately update SmartVista SVFE2 to the latest patched version and implement parameterized SQL queries to prevent injection attacks.
Other vulnerabilities in SmartVista SVFE2
See all- CVE-2022-38619Critical
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2022-38618High
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/country_group.jsf. An attacker can exploit this flaw to manipulate database queries.
- CVE-2022-38617High
SmartVista SVFE2 version 2.2.22 contains a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/voiceaudit.jsf. An attacker can exploit this flaw to manipulate database queries.
- CVE-2022-38616High
SmartVista SVFE2 v2.2.22 was found to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf. An attacker can exploit this flaw to manipulate database queries.
Original NVD description (English source)
SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf.