CVE-2022-48601: 
ScienceLogic SL1 Agent vulnerability analysis and mitigation

A SQL injection vulnerability (CVE-2022-48601) was discovered in the "network print report" feature of ScienceLogic SL1 versions 11.1.2 and earlier. The vulnerability was initially reported to the vendor on September 6, 2022, and was publicly disclosed on August 9, 2023. The issue affects the ScienceLogic SL1 platform's reporting functionality (Securifera Advisory).

The vulnerability exists due to unsanitized user-controlled input being passed directly to a SQL query in the network print report feature, allowing for the injection of arbitrary SQL commands that are then executed against the database. The vulnerability has been assigned a CVSS v3.1 score of 8.8 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impact potential (Securifera Advisory).

The vulnerability could allow attackers to execute arbitrary SQL commands against the database, potentially leading to unauthorized access to sensitive data, manipulation of database contents, and compromise of system integrity. The high CVSS score reflects the significant potential impact on confidentiality, integrity, and availability of the affected system (Securifera Advisory).

Users are advised to update to the latest version of ScienceLogic SL1 beyond version 11.1.2 to address this vulnerability (Securifera Advisory).

The disclosure process faced significant resistance from the vendor, who initially refused CVE issuance and disclosure. The vendor hired a law firm to manage the disclosure process and strongly advised against disclosing to MITRE. Despite these challenges, the vulnerability was eventually publicly disclosed (Securifera Advisory).