Vulnerability · Published Jan 10, 2023 · Assigned by TR-CERT
CVE-2022-4422SQLi in Bulutdesk Callcenter
Critical 9.8
In plain English
A critical-severity SQL injection in Bulutdesk Callcenter from Bulutses Information Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 49.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in the version 3.0
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bulutses Information Technologies | Bulutdesk Callcenter | 0 – before 3.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.usom.gov.tr/bildirim/tr-22-0747 government-resource, broken-link
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-22-0747 government-resource