CVE-2022-24407 SQL injection in n/a

High 8.8 Published 23 Feb 2022 Updated 14 Oct 2026

Attackers can inject SQL commands via unescaped passwords in Cyrus SASL, potentially modifying or reading database contents.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-24407?

CVE-2022-24407 is a high-severity SQL injection vulnerability in Debian Debian Linux, published on 23 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

Weakness: CWE-89

Which versions are affected by CVE-2022-24407?

It affects 8 products.

Linux distribution packages (40)

`cyrus-sasl` AlmaLinux:8	All versions	`2.1.27-6.el8_5`
`cyrus-sasl-devel` AlmaLinux:8	All versions	`2.1.27-6.el8_5`
`cyrus-sasl-gs2` AlmaLinux:8	All versions	`2.1.27-6.el8_5`
`cyrus-sasl-gssapi` AlmaLinux:8	All versions	`2.1.27-6.el8_5`
`cyrus-sasl-ldap` AlmaLinux:8	All versions	`2.1.27-6.el8_5`
`cyrus-sasl-lib` AlmaLinux:8	All versions	`2.1.27-6.el8_5`
`cyrus-sasl-md5` AlmaLinux:8	All versions	`2.1.27-6.el8_5`
`cyrus-sasl-ntlm` AlmaLinux:8	All versions	`2.1.27-6.el8_5`
`cyrus-sasl-plain` AlmaLinux:8	All versions	`2.1.27-6.el8_5`
`cyrus-sasl-scram` AlmaLinux:8	All versions	`2.1.27-6.el8_5`
`cyrus-sasl-sql` AlmaLinux:8	All versions	`2.1.27-6.el8_5`
`cyrus-sasl` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-devel` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-gs2` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-gssapi` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-ldap` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-lib` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-md5` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-ntlm` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-plain` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-scram` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-sql` Red Hat:enterprise_linux:7::client	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-gs2` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-ldap` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-ntlm` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-scram` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-sql` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl` Red Hat:enterprise_linux:7::server	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-devel` Red Hat:enterprise_linux:7::server	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-gs2` Red Hat:enterprise_linux:7::server	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-gssapi` Red Hat:enterprise_linux:7::server	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-ldap` Red Hat:enterprise_linux:7::server	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-lib` Red Hat:enterprise_linux:7::server	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-md5` Red Hat:enterprise_linux:7::server	All versions	`0:2.1.26-24.el7_9`
`cyrus-sasl-ntlm` Red Hat:enterprise_linux:7::server	All versions	`0:2.1.26-24.el7_9`

Products include Cyrusimap Cyrus-Sasl, Debian Debian Linux, Fedoraproject Fedora, Netapp Active Iq Unified Manager, Netapp Ontap Select Deploy Administration Utility, Oracle Communications Cloud Native Core Console and 2 more.

How do I fix CVE-2022-24407?

Upgrade to a fixed version.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-24407 being exploited?

There is no known exploitation of CVE-2022-24407 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2022-24407, ALSA-2022:0658, AZL-8794, CLEANSTART-2024-DV01565, CLSA-2022-1646060576, CLSA-2022-1646060797 and 28 more.