CVE-2024-2022
Published: 01 March 2024
Summary
CVE-2024-2022 is a medium-severity SQL Injection (CWE-89) vulnerability in Netentsec Application Security Gateway. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability identified as CVE-2024-2022 affects Netentsec NS-ASG Application Security Gateway version 6.3. It is an SQL injection flaw in the file /admin/list_ipAddressPolicy.php, where manipulation of the GroupId argument allows arbitrary SQL commands to be executed. The issue carries a CVSS 3.1 score of 6.3 and is tracked under CWE-89.
The attack can be launched remotely by an authenticated user with low privileges and requires no user interaction. Successful exploitation yields limited impacts on confidentiality, integrity, and availability. An exploit for the flaw has been publicly disclosed and may be used.
No vendor patch or mitigation guidance is available, as the vendor did not respond to early disclosure attempts. The associated EPSS score stands at 0.8682 with no indicated rise after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-26992
Vulnerability details
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/list_ipAddressPolicy.php. The manipulation of the argument GroupId leads to sql injection. The…
more
attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255301 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in the web interface of a public-facing application security gateway enables exploitation of public-facing applications (T1190) and server software components (T1505), as explicitly mapped by VulDB.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.