CVE-2022-24281: SQL Injection
Published Mar 8, 2022
·Updated
A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). A privileged authenticated attacker could execute arbitrary commands in the local database by sending specially crafted requests to the webserver of the affected application.
Affected Software
1 affected component
Siemens Sinec Network Management System<1.0.3
Event History
Mar 8, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-24281.
2
What is the severity of CVE-2022-24281?
The severity of CVE-2022-24281 is high with a CVSS score of 7.2.
3
Which software versions are affected by this vulnerability?
SINEC NMS (All versions < V1.0.3) and SINEMA Server V14 (All versions) are affected.
4
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by sending specially crafted requests to the webserver of the affected application.
5
Is authentication required for exploiting CVE-2022-24281?
Yes, a privileged authenticated attacker is required to exploit CVE-2022-24281.