PT-2022-25666
CVE-2022-41133
·
تاريخ النشر
2022-10-27
·
تاريخ التحديث
2022-10-28
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
DIAEnergie versions prior to v1.9.01.002
Description
The issue concerns a SQL injection in the
GetDIAE line message settingsListParameters function. A low-privileged authenticated attacker could exploit this to inject arbitrary SQL queries.Recommendations
For versions prior to v1.9.01.002, update to version v1.9.01.002 or later to resolve the issue. As a temporary workaround, consider restricting access to the
GetDIAE line message settingsListParameters function until a patch is available. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾