CVE-2022-26986

{"id": "CVE-2022-26986", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2022-04-05T15:15:08.597", "references": [{"url": "http://packetstormsecurity.com/files/171485/ImpressCMS-1.4.3-SQL-Injection.html", "source": "cve@mitre.org"}, {"url": "https://github.com/sartlabs/0days/blob/main/ImpressCMS1.4.3/Exploit.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system."}, {"lang": "es", "value": "Una inyecci\u00f3n SQL en ImpressCMS versiones 1.4.3 y anteriores, permite a atacantes remotos inyectar en el c\u00f3digo de forma no intencionada, esto permite a un atacante leer y modificar la informaci\u00f3n confidencial de la base de datos utilizada por la aplicaci\u00f3n. Si es configurada inapropiadamente, un atacante puede incluso cargar una shell web maliciosa para comprometer todo el sistema"}], "lastModified": "2023-03-27T18:15:11.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:impresscms:impresscms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50AAF76B-773D-4011-A958-2EF994347075", "versionEndIncluding": "1.4.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}