CVE-2022-2177 - Vulnerability Details - OpenCVE

Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Kayrasoft	Kayrasoft

Configuration 1 [-]

OR	cpe:2.3:a:kayrasoft:kayrasoft:-:::::::*
	cpe:2.3:a:kayrasoft:kayrasoft:1:::::::*

No data.

References

Link	Providers
https://www.usom.gov.tr/bildirim/tr-22-0630

History

Tue, 17 Sep 2024 02:45:00 +0000

Type	Values Removed	Values Added
Description	Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.	Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2022-09-20T10:40:14.798743Z

Updated: 2024-09-17T02:41:48.875Z

Reserved: 2022-06-22T00:00:00

Link: CVE-2022-2177

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-09-20T11:15:09.350

Modified: 2024-11-21T07:00:28.937

Link: CVE-2022-2177

Redhat

No data.

{"containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Kayrasoft", "vendor": "Kayrasoft", "versions": [{"lessThan": "2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Bartu Utku Sarp"}], "datePublic": "2022-09-19T21:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.</p>"}], "value": "Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2023-09-03T15:49:26.232Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.usom.gov.tr/bildirim/tr-22-0630"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Kayrasoft should be updated to the v2 version provided by the vendor. </p>"}], "value": "Kayrasoft should be updated to the v2 version provided by the vendor."}], "source": {"advisory": "TR-22-0630", "defect": ["TR-22-0630"], "discovery": "EXTERNAL"}, "title": "SQL Injection in Kayrasoft", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@usom.gov.tr", "DATE_PUBLIC": "2022-09-20T15:00:00.000Z", "ID": "CVE-2022-2177", "STATE": "PUBLIC", "TITLE": "SQL Injection in Kayrasoft"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Kayrasoft", "version": {"version_data": [{"version_affected": "<", "version_value": "2"}]}}]}, "vendor_name": "Kayrasoft"}]}}, "credit": [{"lang": "eng", "value": "Bartu Utku Sarp"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89 SQL Injection"}]}]}, "references": {"reference_data": [{"name": "https://www.usom.gov.tr/bildirim/tr-22-0630", "refsource": "CONFIRM", "url": "https://www.usom.gov.tr/bildirim/tr-22-0630"}]}, "solution": [{"lang": "en", "value": "Kayrasoft should be updated to the v2 version provided by the vendor."}], "source": {"advisory": "TR-22-0630", "defect": ["TR-22-0630"], "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:32:08.580Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.usom.gov.tr/bildirim/tr-22-0630"}]}]}, "cveMetadata": {"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "assignerShortName": "TR-CERT", "cveId": "CVE-2022-2177", "datePublished": "2022-09-20T10:40:14.798743Z", "dateReserved": "2022-06-22T00:00:00", "dateUpdated": "2024-09-17T02:41:48.875Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kayrasoft:kayrasoft:-:*:*:*:*:*:*:*", "matchCriteriaId": "3723EF99-D3F3-4B43-9E49-991988496707", "vulnerable": true}, {"criteria": "cpe:2.3:a:kayrasoft:kayrasoft:1:*:*:*:*:*:*:*", "matchCriteriaId": "A81DFE6C-26D1-4EA8-9DE7-DFBE54692676", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2."}, {"lang": "es", "value": "El producto Kayrasoft versiones anteriores a 2, presenta una vulnerabilidad de inyecci\u00f3n SQL no autenticada. Esto ha sido corregido en versi\u00f3n 2"}], "id": "CVE-2022-2177", "lastModified": "2024-11-21T07:00:28.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "iletisim@usom.gov.tr", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2022-09-20T11:15:09.350", "references": [{"source": "iletisim@usom.gov.tr", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://www.usom.gov.tr/bildirim/tr-22-0630"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://www.usom.gov.tr/bildirim/tr-22-0630"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Secondary"}]}