CVE-2023-22268 ZDI-CAN-21308: Adobe RoboHelp Server getRHSGroupsForRoles SQL Injection Information Disclosure Vulnerability

What is CVE-2023-22268?

CVE-2023-22268 is a medium-severity SQL injection vulnerability in Adobe RoboHelp, published on 17 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to information disclosure by an low-privileged authenticated attacker. Exploitation of this issue does not require user interaction.

Weakness: CWE-89

Which versions are affected by CVE-2023-22268?

It affects 1 product.

Products include Adobe Robohelp Server.

How do I fix CVE-2023-22268?

No fix has been published for CVE-2023-22268 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2023-22268 being exploited?

There is no known exploitation of CVE-2023-22268 in the wild and no public exploit code.

Other vulnerabilities in Adobe RoboHelp

• CVE-2009-3068 File upload in n/a Critical 9.3
• CVE-2022-30670 Escalate Privileges to Server Admin - Robohelp Server High 8.8
• CVE-2021-28588 Adobe RoboHelp Server folderId Directory Traversal Remote Code Execution Vulnerability High 8.8
• CVE-2021-42727 Adobe Bridge Buffer Overflow Arbitrary code execution High 7.8
• CVE-2023-22272 ZDI-CAN-21309: Adobe RoboHelp Server resolveDistinguishedName LDAP Injection Information Disclosure Vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-ch3p-vmmr-63xx.