Vulnerability · Published Nov 11, 2022 · Assigned by GitHub_M
CVE-2022-41892Arches vulnerable to SQL Injection
High 8.6
In plain English
A high-severity SQL injection in arches from archesproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in version 7.12, 6.2.1, and 6.1.2. Users are recommended to upgrade as soon as possible. There are no workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | arches | 6.1.2 | GHSA-gmpq-xrxj-xh8m |
| PyPI | arches | 6.2.1 | GHSA-gmpq-xrxj-xh8m |
| PyPI | arches | 7.2.0 | GHSA-gmpq-xrxj-xh8m |
| PyPI | arches | 6.1.2 | PYSEC-2022-42985 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| archesproject | arches | <= 6.1.2>= 6.2.0, < 6.2.1>= 7.0.0, < 7.1.2 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L