CVE-2022-43842 IBM Aspera Console SQL injection
Remote attackers can inject SQL to view, add, modify, or delete database information in IBM Aspera Console.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-43842?
CVE-2022-43842 is a high-severity SQL injection vulnerability in IBM Aspera Console, published on 23 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Aspera Console 3.4.0 through 3.4.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 239079.
Weakness: CWE-89
Which versions are affected by CVE-2022-43842?
It affects 1 product.
Products include Ibm Aspera Console.
How do I fix CVE-2022-43842?
No fix has been published for CVE-2022-43842 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-43842 being exploited?
There is no known exploitation of CVE-2022-43842 in the wild and no public exploit code.
Other vulnerabilities in IBM Aspera Console
- CVE-2025-13379 A SQL Injection vulnerability has been addressed in IBM Aspera Console
- CVE-2021-38963 IBM Aspera Console CSV injection
- CVE-2021-38927 IBM Aspera Console cross-site scripting
- CVE-2022-43851 IBM Aspera Console information disclosure
- CVE-2022-43847 IBM Aspera Console HTTP header injection
Sources
Also known as GHSA-w45p-956p-xwwp.