CVE-2022-24831

OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vulnerable to SQL injection due to the use of string concatenation to create SQL queries instead of prepared statements. No known workarounds exist. This issue has been patched in 3.16.1, 3.15.9, 3.14.1, and 3.13.1 and users are advised to upgrade.

CVSS v3 8.3 HIGH
CVSS v2.0 7.5 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/OpenClinica/OpenClinica/pull/3490/commits/b152cc63019230c9973965a98e4386ea5322c18f	Patch Third Party Advisory
https://github.com/OpenClinica/OpenClinica/security/advisories/GHSA-5289-4jwp-xp9h	Patch Third Party Advisory
https://github.com/OpenClinica/OpenClinica/pull/3490/commits/b152cc63019230c9973965a98e4386ea5322c18f	Patch Third Party Advisory
https://github.com/OpenClinica/OpenClinica/security/advisories/GHSA-5289-4jwp-xp9h	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openclinica:openclinica::::::::
	cpe:2.3:a:openclinica:openclinica::::::::
	cpe:2.3:a:openclinica:openclinica::::::::
	cpe:2.3:a:openclinica:openclinica:3.14:::::::*

History

No history.

Information

Published : 2022-05-14 01:15

Updated : 2024-11-21 06:51

NVD link : CVE-2022-24831

Mitre link : CVE-2022-24831

CVE.ORG link : CVE-2022-24831

JSON object : View

Products Affected

openclinica

openclinica

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2022-24831", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-05-14T01:15:06.847", "references": [{"url": "https://github.com/OpenClinica/OpenClinica/pull/3490/commits/b152cc63019230c9973965a98e4386ea5322c18f", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenClinica/OpenClinica/security/advisories/GHSA-5289-4jwp-xp9h", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenClinica/OpenClinica/pull/3490/commits/b152cc63019230c9973965a98e4386ea5322c18f", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/OpenClinica/OpenClinica/security/advisories/GHSA-5289-4jwp-xp9h", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vulnerable to SQL injection due to the use of string concatenation to create SQL queries instead of prepared statements. No known workarounds exist. This issue has been patched in 3.16.1, 3.15.9, 3.14.1, and 3.13.1 and users are advised to upgrade."}, {"lang": "es", "value": "OpenClinica es un software de c\u00f3digo abierto para la captura electr\u00f3nica de datos (EDC) y la administraci\u00f3n de datos cl\u00ednicos (CDM). Las versiones anteriores a 3.16.1, son vulnerables a una inyecci\u00f3n SQL debido al uso de la concatenaci\u00f3n de cadenas para crear consultas SQL en lugar de sentencias preparadas. No se presentan medidas de mitigaci\u00f3n conocidas. Este problema ha sido parcheado en versiones 3.16.1, 3.15.9, 3.14.1 y 3.13.1 y es recomendado a usuarios actualizar"}], "lastModified": "2024-11-21T06:51:11.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openclinica:openclinica:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87276F61-A83D-46B4-9733-75F8FA71D3BB", "versionEndExcluding": "3.13.1"}, {"criteria": "cpe:2.3:a:openclinica:openclinica:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6CDC0C5-D124-449C-A54E-9F468D5FE00A", "versionEndExcluding": "3.15.9", "versionStartExcluding": "3.15"}, {"criteria": "cpe:2.3:a:openclinica:openclinica:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FE462A1-C131-4F1D-93BD-4F5F9EC3986B", "versionEndExcluding": "3.16.1", "versionStartExcluding": "3.16"}, {"criteria": "cpe:2.3:a:openclinica:openclinica:3.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A433705E-18AD-4645-921D-0479715075E0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}