CVE-2025-46546

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-46546
In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/files/export/csv/, /api/gui/files/list, /api/gui/process/export/csv, /api/gui/process/export/xlsx, /api/gui/process/listAll, /api/gui/processVersion/export/csv/, /api/gui/processVersion/export/xlsx/, /api/gui/processVersion/list/, /api/gui/robot/list/, /api/gui/task/export/csv/, /api/gui/task/export/xlsx/, and /api/gui/task/list/.

3.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://deiteriy.com
https://gist.github.com/ArtemBrylev/59b4c0825a988f39a58b79e4e8d2f378
https://sherparpa.com
https://twitter.com/ArtyomBrylev
Configurations

No configuration.

History

29 Apr 2025, 13:52

Type Values Removed Values Added
Summary
  • (es) En Sherpa Orchestrator 141851, un usuario autenticado puede realizar múltiples inyecciones SQL ciegas basadas en tiempo. Esto afecta a api/gui/asset/list, /api/gui/files/export/csv/, /api/gui/files/list, /api/gui/process/export/csv, /api/gui/process/export/xlsx, /api/gui/process/listAll, /api/gui/processVersion/export/csv/, /api/gui/processVersion/export/xlsx/, /api/gui/processVersion/list/, /api/gui/robot/list/, /api/gui/task/export/csv/, /api/gui/task/export/xlsx/ y /api/gui/task/list/.

25 Apr 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-25 03:15

Updated : 2025-04-29 13:52

NVD link : CVE-2025-46546

Mitre link : CVE-2025-46546

CVE.ORG link : CVE-2025-46546

JSON object : View

Products Affected

No product.

CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')