CVE-2022-38618
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/country_group.jsf. An attacker can exploit this flaw to manipulate database queries.
Risk Assessment
The risk involves unauthorized access, modification, or deletion of data, potentially compromising the confidentiality and integrity of the system.
Recommendation
Immediately update SmartVista SVFE2 to the latest version and implement SQL query parameterization or input validation.
Other vulnerabilities in SmartVista SVFE2
See all- CVE-2022-38619Critical
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2022-38617High
SmartVista SVFE2 version 2.2.22 contains a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/voiceaudit.jsf. An attacker can exploit this flaw to manipulate database queries.
- CVE-2022-38616High
SmartVista SVFE2 v2.2.22 was found to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf. An attacker can exploit this flaw to manipulate database queries.
- CVE-2022-38615High
SmartVista SVFE2 v2.2.22 was found to contain multiple SQL injection vulnerabilities in the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf. An attacker can exploit these flaws to manipulate database queries.
Original NVD description (English source)
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/country_group.jsf.