cvelist/2022/1xxx/CVE-2022-1358.json

{
    "CVE_data_meta": {
        "ASSIGNER": "ics-cert@hq.dhs.gov",
        "DATE_PUBLIC": "2022-05-12T16:26:00.000Z",
        "ID": "CVE-2022-1358",
        "STATE": "PUBLIC",
        "TITLE": "Cambium Networks cnMaestro SQL Injection"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "product": {
                        "product_data": [
                            {
                                "product_name": "cnMaestro",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_value": "3.0.3-r32"
                                        },
                                        {
                                            "version_affected": "<",
                                            "version_value": "2.4.2-r29"
                                        },
                                        {
                                            "version_affected": "<",
                                            "version_value": "3.0.0-r34"
                                        }
                                    ]
                                }
                            }
                        ]
                    },
                    "vendor_name": "Cambium Networks"
                }
            ]
        }
    },
    "credit": [
        {
            "lang": "eng",
            "value": "Noam Moshe of Claroty reported these vulnerabilities to CISA."
        }
    ],
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "The affected On-Premise is vulnerable to data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an attacker to exfiltrate and dump all data held in the cnMaestro database."
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.0.9"
    },
    "impact": {
        "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
        }
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-89 SQL Injection"
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04",
                "refsource": "CONFIRM",
                "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04"
            }
        ]
    },
    "solution": [
        {
            "lang": "eng",
            "value": "Cambium Networks recommends affected users apply one of the following upgrade packages:\n\n3.0.3-r32\n2.4.2-r29\n3.0.0-r34\nThe security patches are available from Cambium Networks support (login required).\n\nFor users of cnMaestro Cloud, these vulnerabilities have been patched by Cambium Networks and no further action is required."
        }
    ],
    "source": {
        "discovery": "UNKNOWN"
    }
}