CVE-2022-3323

high · 7.5

An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password.

7.5

CVSS

28.6%

EPSS (exploit prob.)

98th

EPSS percentile

2022-09-27

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
advantech	iview	5.7.04.6469

Check a specific version with /api/v1/cve/match.

References

https://www.tenable.com/security/research/tra-2022-32
https://www.tenable.com/security/research/tra-2022-32

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-3323