CVE-2022-48602: 
ScienceLogic SL1 Agent vulnerability analysis and mitigation

A SQL injection vulnerability (CVE-2022-48602) was discovered in the "message viewer print" feature of ScienceLogic SL1 versions 11.1.2 and earlier. The vulnerability was identified in September 2022 and publicly disclosed on August 9, 2023. The issue stems from unsanitized user-controlled input being passed directly to SQL queries, affecting the ScienceLogic SL1 platform (Securifera Advisory).

The vulnerability allows for the injection of arbitrary SQL commands that are executed against the database. The CVSS v3.1 score is 8.8 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs low privileges, requires no user interaction, and can result in high impacts to confidentiality, integrity, and availability (Securifera Advisory).

The vulnerability can lead to unauthorized access to the database, potentially allowing attackers to view, modify, or delete sensitive information. The high CVSS score indicates severe potential consequences, including complete compromise of system confidentiality, integrity, and availability (Securifera Advisory).

The vulnerability requires low attack complexity and only low-level privileges to exploit, making it relatively accessible to attackers. The network attack vector means it can be exploited remotely, and no user interaction is required for successful exploitation (Securifera Advisory).

Users are advised to update to the latest version of ScienceLogic SL1 beyond version 11.1.2 to address this vulnerability (Securifera Advisory).

The disclosure process faced significant resistance from the vendor, who initially refused CVE issuance and disclosure. The vendor hired a law firm to manage the disclosure process and strongly advised against disclosing to MITRE. Despite these challenges, the vulnerability was eventually publicly disclosed on August 9, 2023 (Securifera Advisory).