SonicWall: Patch critical SQL injection bug immediately

guest · Jul 22, 2022

July 22, 2022

SonicWall has published a security advisory today to warn of a critical SQL injection flaw impacting the GMS (Global Management System) and Analytics On-Prem products.

The flaw, tracked as CVE-2022-22280, allows SQL injection due to improper neutralization of special elements used in an SQL Command.
Click to expand...

It carries a severity rating of 9.4, categorizing it as “critical”, and is exploitable from the network without requiring authentication or user interaction, while it also has low attack complexity.

Considering the widespread deployment of SonicWall GMS and Analytics, which are used for central management, rapid deployment, real-time reporting, and data insight, the attack surface is significant and typically on critical organizations.
Click to expand...

The recommended action to resolve this vulnerability is to upgrade to GMS 9.3.1-SP2-Hotfix-2 or later and Analytics 2.5.0.3-Hotfix-1 or later. Any version number below these is vulnerable to CVE-2022-22280.

Currently, there is no workaround available for this vulnerability, so all administrators are advised to apply the available security updates.
Click to expand...

Log in or Sign up

SonicWall: Patch critical SQL injection bug immediately

guest Guest

Log in or Sign up

SonicWall: Patch critical SQL injection bug immediately

guest Guest

Useful Searches