What is CVE-2022-38130?

CVE-2022-38130 is a critical-severity vulnerability in Keysight Sensor Management Server, classified under SQL Injection. CVSS score: 9.8/10. Published 2022-08-10.

How severe is CVE-2022-38130?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2022-38130 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Keysight Sensor Management Server

CVE-2022-38130

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file (i.e., \\<attacker-host>\sms\<attacker-db.zip>), effectively controlling the content of the database to be restored.

Vulnerability class: SQL Injection

EPSS: 0.541 (98.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Keysight Sensor_management_server — versions 2.4.0
N/a Keysight Technologies Sensor Management Server — versions Keysight Technologies Sensor Management Server v2.4.0

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

vulnreport@tenable.com (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-38130?: CVE-2022-38130 is a critical-severity vulnerability in Keysight Sensor Management Server, classified under SQL Injection. CVSS score: 9.8/10. Published 2022-08-10.
How severe is CVE-2022-38130?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2022-38130 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.