CVE-2022-38616
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
SmartVista SVFE2 v2.2.22 was found to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf. An attacker can exploit this flaw to manipulate database queries.
Risk Assessment
The risk includes unauthorized access, modification, or deletion of data, potentially compromising system confidentiality and integrity.
Recommendation
Immediately update SmartVista SVFE2 to the latest version and implement parameterized SQL queries to prevent injection attacks.
Other vulnerabilities in SmartVista SVFE2
See all- CVE-2022-38619Critical
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2022-38618High
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/country_group.jsf. An attacker can exploit this flaw to manipulate database queries.
- CVE-2022-38617High
SmartVista SVFE2 version 2.2.22 contains a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/voiceaudit.jsf. An attacker can exploit this flaw to manipulate database queries.
- CVE-2022-38615High
SmartVista SVFE2 v2.2.22 was found to contain multiple SQL injection vulnerabilities in the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf. An attacker can exploit these flaws to manipulate database queries.
Original NVD description (English source)
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf.