Skip to content
Fencer Vulns
medium 6.3

CVE-2022-3801 json

IBAX go-ibax rowsInfo sql injection

published 2022-11-01 4 y ago modified 2026-06-17 4 mo ago also GHSA-m738-584h-26p6 , GO-2024-2775 , EUVD-2022-7381

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
30.1%
EPSS 30.1% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

A vulnerability, which was classified as critical, was found in IBAX go-ibax. This affects an unknown part of the file /api/v2/open/rowsInfo. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212637 was assigned to this vulnerability.

Patch / fix

  • go github.com/IBAX-io/go-ibax 1.4.2

Exploit prediction

30.08% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/IBAX-io/go-ibax
<1.4.2
1.4.2

Affected products

  • IBAX go-ibax

Classification

Weakness
  • CWE-707 Improper Neutralization
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.