« Volver al listado

CVE-2022-24831

Estado: ModificadaCrítica (9.8)—

OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vulnerable to SQL injection due to the use of string concatenation to create SQL queries instead of prepared statements. No known workarounds exist. This issue has been patched in 3.16.1, 3.15.9, 3.14.1, and 3.13.1 and users are advised to upgrade.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openclinica — Openclinica

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-24831",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-24831",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T15:53:16.141282Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "OpenClinica",
          "product": "OpenClinica",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.13.1"
            },
            {
              "status": "affected",
              "version": ">= 3.14, < 3.14.1"
            },
            {
              "status": "affected",
              "version": ">= 3.15, < 3.15.9"
            },
            {
              "status": "affected",
              "version": ">= 3.16, < 3.16.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-05-14T01:15:06.847",
  "references": [
    {
      "url": "https://github.com/OpenClinica/OpenClinica/pull/3490/commits/b152cc63019230c9973965a98e4386ea5322c18f",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/OpenClinica/OpenClinica/security/advisories/GHSA-5289-4jwp-xp9h",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/OpenClinica/OpenClinica/pull/3490/commits/b152cc63019230c9973965a98e4386ea5322c18f",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/OpenClinica/OpenClinica/security/advisories/GHSA-5289-4jwp-xp9h",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vulnerable to SQL injection due to the use of string concatenation to create SQL queries instead of prepared statements. No known workarounds exist. This issue has been patched in 3.16.1, 3.15.9, 3.14.1, and 3.13.1 and users are advised to upgrade."
    },
    {
      "lang": "es",
      "value": "OpenClinica es un software de código abierto para la captura electrónica de datos (EDC) y la administración de datos clínicos (CDM). Las versiones anteriores a 3.16.1, son vulnerables a una inyección SQL debido al uso de la concatenación de cadenas para crear consultas SQL en lugar de sentencias preparadas. No se presentan medidas de mitigación conocidas. Este problema ha sido parcheado en versiones 3.16.1, 3.15.9, 3.14.1 y 3.13.1 y es recomendado a usuarios actualizar"
    }
  ],
  "lastModified": "2026-06-17T04:32:37.093",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openclinica:openclinica:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87276F61-A83D-46B4-9733-75F8FA71D3BB",
              "versionEndExcluding": "3.13.1"
            },
            {
              "criteria": "cpe:2.3:a:openclinica:openclinica:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6CDC0C5-D124-449C-A54E-9F468D5FE00A",
              "versionEndExcluding": "3.15.9",
              "versionStartExcluding": "3.15"
            },
            {
              "criteria": "cpe:2.3:a:openclinica:openclinica:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FE462A1-C131-4F1D-93BD-4F5F9EC3986B",
              "versionEndExcluding": "3.16.1",
              "versionStartExcluding": "3.16"
            },
            {
              "criteria": "cpe:2.3:a:openclinica:openclinica:3.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A433705E-18AD-4645-921D-0479715075E0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}