CVE-2022-30619
MEDIUMAgilePoint NX < 8.0 - Authenticated SQL Injection via EncodedData Parameter
Title source: llmDescription
Editable SQL Queries behind Base64 encoding sending from the Client-Side to The Server-Side for a particular API used in legacy Work Center module. He attack is available for any authenticated user, in any kind of rule. under the function : /AgilePointServer/Extension/FetchUsingEncodedData in the parameter: EncodedData
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.gov.il/en/Departments/faq/cve_advisories
Scores
CVSS v3
5.9
EPSS
0.0070
EPSS Percentile
49.0%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
Details
CWE
CWE-89
Status
published
Products (1)
agilepoint/agilepoint_nx
< 8.0
Published
Jul 06, 2022
Tracked Since
Feb 18, 2026