CVE-2022-28862

CRITICAL 9.8CVE-2022-28862 · Published 25/05/2022 · updated 17/06/2026

In short

CVE-2022-28862 is a CRITICAL (CVSS 9.8) vulnerability affecting web central (archibus).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 64.6% of all vulnerabilities.
Fix: update to 26.2 or later.

Package	Affected versions	Patched versions
web central archibus	`< 26.2`	`26.2`

Description

In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr. Through the injection of arbitrary SQL statements, a potential attacker can modify query syntax and perform unauthorized (and unexpected) operations against the remote database. This is fixed in all recent versions, such as version 26.2.

References

gruppotim.it/it/footer/red-team.html · Third Party Advisory
telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html · Third Party Advisory

More vulnerabilities in web central

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

web central

archibus

< 26.2

26.2

Description

More vulnerabilities in web central

See all →