CVE-2022-30619

Name of the Vulnerable Software and Affected Versions AgilePointServer (affected versions not specified)

Description The issue concerns editable SQL queries that are Base64 encoded and sent from the client-side to the server-side for a specific API used in the legacy Work Center module. This can be exploited by any authenticated user, regardless of the rule type, by utilizing the /AgilePointServer/Extension/FetchUsingEncodedData API endpoint with the EncodedData parameter.

Recommendations For AgilePointServer, as a temporary workaround, consider restricting access to the /AgilePointServer/Extension/FetchUsingEncodedData API endpoint until a patch is available. Additionally, avoid using the EncodedData parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.