CVE Vulnerability

CVE-2022-38488

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://archive.ph/VlGDa Technical Description Third Party Advisory
https://archive.ph/PecmD Third Party Advisory
https://github.com/secoats/cve/tree/master/CVE-2022-38488_sqli_logrocket-oauth2-example Exploit Third Party Advisory
https://github.com/diogosouza/logrocket-oauth2-example Broken Link
https://blog.logrocket.com/implement-oauth-2-0-node-js/ Product Technical Description
Configurations

Configuration 1

cpe:2.3:a:logrocket-oauth2-example_project:logrocket-oauth2-example:*:*:*:*:*:*:*:*
Information

Published : 2022-12-14 09:15

Updated : 2022-12-19 05:56

NVD link : CVE-2022-38488

Mitre link : CVE-2022-38488

Products Affected
No products.
CWE
CWE-89