CVE-2022-38541 - Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface

Back Back to CVE browser

CRITICAL

Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface

Published Sep 13, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.22%

Description

Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/
Third Party Advisory
https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L136
Third Party Advisory
https://github.com/hhyo/Archery/issues/1842
ExploitIssue TrackingThird Party Advisory

Link	Providers	Tags
https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/		Third Party Advisory
https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L136		Third Party Advisory
https://github.com/hhyo/Archery/issues/1842		ExploitIssue TrackingThird Party Advisory