CVE-2022-41892 json
Arches vulnerable to SQL Injection
published 3y ago modified 4mo ago also GHSA-gmpq-xrxj-xh8m , PYSEC-2022-42985 , EUVD-2022-0027
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in version 7.12, 6.2.1, and 6.1.2. Users are recommended to upgrade as soon as possible. There are no workarounds.
Patch / fix
- pypi arches 6.1.2, 6.2.1, 7.2.0
Is CVE-2022-41892 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | arches | <6.1.2 >=6.2.0, <6.2.1 >=7.0.0, <7.2.0 |
6.1.2 6.2.1 7.2.0 |
Affected products
- archesproject arches
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/archesproject/arches/security/advisories/GHSA-gmpq-xrxj-xh8m
web, patch, third-party-advisory, advisory
-
github.com
/archesproject/arches/commit/7ed53e23a616edf3301d95814d9d64de5e3072a9
web
-
nvd.nist.gov
/vuln/detail/CVE-2022-41892
advisory
-
github.com
/archesproject/arches
package
-
github.com
/pypa/advisory-database/tree/main/vulns/arches/PYSEC-2022-42985.yaml
web
-
pypi.org
/project/arches/6.1.2
web
-
pypi.org
/project/arches/7.2.0
web
-
securitylab.github.com
/advisories/GHSL-2022-070_GHSL-2022-072_Arches
advisory
Sources
- CVE List CVE-2022-41892
- GitHub Advisory GHSA-gmpq-xrxj-xh8m
- NVD CVE-2022-41892
- OSV PYSEC-2022-42985
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.