CVE-2022-22149 - A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2

Back Back to CVE browser

HIGH

A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2

Published Apr 14, 2022

8.8

HIGH

CVSS 3.1

EPSS 72.60%

Description

A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected products

Vendor Lansweeper Product Lansweeper Default
n/a
- Version
  9.1.20.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Lansweeper

n/a

Version	Status	Constraints
9.1.20.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-27296
Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1441
x_refsource_MISCExploitThird Party Advisory
https://www.lansweeper.com/changelog/
x_refsource_CONFIRMRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-27296		Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1441		x_refsource_MISCExploitThird Party Advisory
https://www.lansweeper.com/changelog/		x_refsource_CONFIRMRelease NotesVendor Advisory