CVE-2022-39817 SQL injection in n/a
An authenticated attacker can inject SQL statements to perform unauthorized database operations in Nokia 1350 OMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-39817?
CVE-2022-39817 is a high-severity SQL injection vulnerability in n/a, published on 13 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In NOKIA 1350 OMS R14.2, multiple SQL Injection vulnerabilities occurs. Exploitation requires an authenticated attacker. Through the injection of arbitrary SQL statements, a potential authenticated attacker can modify query syntax and perform unauthorized (and unexpected) operations against the remote database.
Weakness: CWE-89
Which versions are affected by CVE-2022-39817?
It affects 1 product.
Products include Nokia 1350 Optical Management System.
How do I fix CVE-2022-39817?
No fix has been published for CVE-2022-39817 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-39817 being exploited?
There is no known exploitation of CVE-2022-39817 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xc67-xj3h-6w7f.