CVE-2022-4557 - SQL Injection in Smartpower Web

Back Back to CVE browser

CRITICAL

SQL Injection in Smartpower Web

Published Feb 9, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.66%

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection.

This issue affects Smartpower Web: before 23.01.01.

Affected products

Vendor Group Arge Energy and Control Systems Product Smartpower Web Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <23.01.01

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Group Arge Energy and Control Systems

Smartpower Web

unaffected

Version	Status	Constraints
0	affected	<23.01.01

Remediation

Vendor solution

Update the software to >= 23.01.01

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51892
Advisory
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0066
government-resource
https://www.usom.gov.tr/bildirim/tr-23-0066
government-resourcebroken-linkThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51892		Advisory
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0066		government-resource
https://www.usom.gov.tr/bildirim/tr-23-0066		government-resourcebroken-linkThird Party Advisory