« Volver al listado

CVE-2022-34876

Estado: ModificadaAlta (8.8)—

Una vulnerabilidad de inyección SQL en la interfaz de administración (/vicidial/admin.php) de VICIdial por medio de los parámetros modify_email_accounts, access_recordings y agentcall_email permite al atacante falsificar la identidad, alterar los datos existentes, permitir la divulgación completa de todos los datos en el sistema, destruir los datos o deje que no esté disponible y conviértase en administrador del servidor de la base de datos. Este problema afecta: VICIdial versiones 2.14b0.5 anteriores a 3555

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vicidial — Vicidial

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-34876",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@rapid7.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@rapid7.com",
      "affectedData": [
        {
          "vendor": "VICIdial",
          "product": "VICIdial",
          "versions": [
            {
              "status": "affected",
              "version": "2.14b0.5",
              "lessThan": "3555",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-05T16:15:08.033",
  "references": [
    {
      "url": "https://github.com/rapid7/metasploit-framework/pull/16732",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/pull/16732",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@rapid7.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL en la interfaz de administración (/vicidial/admin.php) de VICIdial por medio de los parámetros modify_email_accounts, access_recordings y agentcall_email permite al atacante falsificar la identidad, alterar los datos existentes, permitir la divulgación completa de todos los datos en el sistema, destruir los datos o deje que no esté disponible y conviértase en administrador del servidor de la base de datos. Este problema afecta: VICIdial versiones 2.14b0.5 anteriores a 3555"
    }
  ],
  "lastModified": "2026-06-17T04:51:05.073",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vicidial:vicidial:2.14b0.5:3555:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F2D723A-5E19-41E1-8E36-D749C6A6C25F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@rapid7.com"
}