Vulnerability-Lookup

CVE-2022-46908 (GCVE-0-2022-46908)

Vulnerability from cvelistv5 – Published: 2022-12-12 00:00 – Updated: 2025-05-05 16:11

Summary

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 13:29 UTC

CWE

n/a
NVD-CWE-Other

Assigner

mitre mitre root

References

5 references

URL	Tags
https://news.ycombinator.com/item?id=33948588
https://sqlite.org/forum/forumpost/07beac8056151b2f
https://sqlite.org/src/info/cefc032473ac5ad2
https://security.netapp.com/advisory/ntap-2023020…
https://security.gentoo.org/glsa/202311-03	vendor-advisory

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:47:27.711Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=33948588"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://sqlite.org/forum/forumpost/07beac8056151b2f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://sqlite.org/src/info/cefc032473ac5ad2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230203-0005/"
          },
          {
            "name": "GLSA-202311-03",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-03"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-46908",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:29:30.268008Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "NVD-CWE-Other",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-05T16:11:57.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-24T14:06:18.728Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://news.ycombinator.com/item?id=33948588"
        },
        {
          "url": "https://sqlite.org/forum/forumpost/07beac8056151b2f"
        },
        {
          "url": "https://sqlite.org/src/info/cefc032473ac5ad2"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230203-0005/"
        },
        {
          "name": "GLSA-202311-03",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202311-03"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-46908",
    "datePublished": "2022-12-12T00:00:00.000Z",
    "dateReserved": "2022-12-12T00:00:00.000Z",
    "dateUpdated": "2025-05-05T16:11:57.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-46908",
      "date": "2026-09-16",
      "epss": "0.00425",
      "percentile": "0.36189"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.37.0\", \"versionEndExcluding\": \"3.40.1\", \"matchCriteriaId\": \"B163FB3C-EDA0-4A12-9617-9593654FB0D4\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.\"}, {\"lang\": \"es\", \"value\": \"SQLite hasta 3.40.0, cuando depende de --safe para la ejecuci\\u00f3n de un script CLI que no es de confianza, no implementa correctamente el mecanismo de protecci\\u00f3n azProhibitedFunctions y, en su lugar, permite funciones UDF como WRITEFILE.\"}]",
      "id": "CVE-2022-46908",
      "lastModified": "2024-11-21T07:31:17.790",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.5}]}",
      "published": "2022-12-12T06:15:10.793",
      "references": "[{\"url\": \"https://news.ycombinator.com/item?id=33948588\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202311-03\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20230203-0005/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://sqlite.org/forum/forumpost/07beac8056151b2f\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://sqlite.org/src/info/cefc032473ac5ad2\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://news.ycombinator.com/item?id=33948588\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202311-03\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20230203-0005/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://sqlite.org/forum/forumpost/07beac8056151b2f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://sqlite.org/src/info/cefc032473ac5ad2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2022-12-13T00:00:00.000Z",
      "cve": "CVE-2022-46908",
      "id": "msrc_CVE-2022-46908",
      "initial_release_date": "2022-12-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "SQLite through 3.40.0 when relying on --safe for execution of an untrusted CLI script does not properly implement the azProhibitedFunctions protection mechanism and instead allows UDF functions such as WRITEFILE.",
      "url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2022-46908.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-46908\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-12-12T06:15:10.793\",\"lastModified\":\"2026-06-17T05:12:40.747\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.\"},{\"lang\":\"es\",\"value\":\"SQLite hasta 3.40.0, cuando depende de --safe para la ejecuci\u00f3n de un script CLI que no es de confianza, no implementa correctamente el mecanismo de protecci\u00f3n azProhibitedFunctions y, en su lugar, permite funciones UDF como WRITEFILE.\"}],\"affected\":[{\"source\":\"cve@mitre.org\",\"affectedData\":[{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-04-23T13:29:30.268008Z\",\"id\":\"CVE-2022-46908\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.37.0\",\"versionEndExcluding\":\"3.40.1\",\"matchCriteriaId\":\"B163FB3C-EDA0-4A12-9617-9593654FB0D4\"}]}]}],\"references\":[{\"url\":\"https://news.ycombinator.com/item?id=33948588\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202311-03\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20230203-0005/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://sqlite.org/forum/forumpost/07beac8056151b2f\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://sqlite.org/src/info/cefc032473ac5ad2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://news.ycombinator.com/item?id=33948588\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202311-03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20230203-0005/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://sqlite.org/forum/forumpost/07beac8056151b2f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://sqlite.org/src/info/cefc032473ac5ad2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T11:48:19+00:00",
      "cve": "CVE-2022-46908",
      "id": "CVE-2022-46908",
      "initial_release_date": "2022-12-12T00:00:00+00:00",
      "product_status:known_not_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "sqlite: safe mode authorizer callback allows disallowed UDFs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-46908.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-02T02:08:47Z",
      "cve": "CVE-2022-46908",
      "id": "CVE-2022-46908",
      "initial_release_date": "2023-02-15T03:22:15Z",
      "product_status:known_affected": "175",
      "product_status:known_not_affected": "13",
      "product_status:recommended": "559",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-46908",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-46908.json",
      "version": "63"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://news.ycombinator.com/item?id=33948588\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://sqlite.org/forum/forumpost/07beac8056151b2f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://sqlite.org/src/info/cefc032473ac5ad2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20230203-0005/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.gentoo.org/glsa/202311-03\", \"name\": \"GLSA-202311-03\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T14:47:27.711Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-46908\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T13:29:30.268008Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"NVD-CWE-Other\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-05T13:07:47.024Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"references\": [{\"url\": \"https://news.ycombinator.com/item?id=33948588\"}, {\"url\": \"https://sqlite.org/forum/forumpost/07beac8056151b2f\"}, {\"url\": \"https://sqlite.org/src/info/cefc032473ac5ad2\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20230203-0005/\"}, {\"url\": \"https://security.gentoo.org/glsa/202311-03\", \"name\": \"GLSA-202311-03\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2023-11-24T14:06:18.728Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-46908\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-05T16:11:57.403Z\", \"dateReserved\": \"2022-12-12T00:00:00.000Z\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2022-12-12T00:00:00.000Z\", \"assignerShortName\": \"mitre\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

ubuntu-cve-2022-46908

Vulnerability from osv_ubuntu

Published

2022-12-12 06:15

Modified

2026-04-22 07:41

Summary

Details

Severity

7.3 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

7.3 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2022-46908	REPORT
	https://sqlite.org/forum/forumpost/07beac8056151b2f	REPORT
	https://news.ycombinator.com/item?id=33948588	REPORT
	https://ubuntu.com/security/notices/USN-6566-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2022-46908	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "lemon",
            "binary_version": "3.37.2-2ubuntu0.3"
          },
          {
            "binary_name": "libsqlite3-0",
            "binary_version": "3.37.2-2ubuntu0.3"
          },
          {
            "binary_name": "libsqlite3-tcl",
            "binary_version": "3.37.2-2ubuntu0.3"
          },
          {
            "binary_name": "sqlite3",
            "binary_version": "3.37.2-2ubuntu0.3"
          },
          {
            "binary_name": "sqlite3-tools",
            "binary_version": "3.37.2-2ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "sqlite3",
        "purl": "pkg:deb/ubuntu/sqlite3@3.37.2-2ubuntu0.3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.37.2-2ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.35.5-1",
        "3.36.0-2",
        "3.37.2-2",
        "3.37.2-2ubuntu0.1"
      ]
    }
  ],
  "aliases": [],
  "details": "SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.",
  "id": "UBUNTU-CVE-2022-46908",
  "modified": "2026-04-22T07:41:45Z",
  "published": "2022-12-12T06:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-46908"
    },
    {
      "type": "REPORT",
      "url": "https://sqlite.org/forum/forumpost/07beac8056151b2f"
    },
    {
      "type": "REPORT",
      "url": "https://news.ycombinator.com/item?id=33948588"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6566-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-46908"
    }
  ],
  "related": [
    "USN-6566-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-46908"
  ]
}

WID-SEC-W-2023-1016

Vulnerability from csaf_certbund - Published: 2023-04-18 22:00 - Updated: 2023-12-26 23:00

Summary

Oracle Fusion Middleware: Mehrere Schwachstellen

Severity

Hoch

Scope

39 vulnerabilities in this advisory, including CVE-2022-46908.

CVE-2022-46908

In Oracle Fusion Middleware existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrität und Verfügbarkeit gefährden. Für die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle veröffentlicht keine weiteren Details zu diesen Schwachstellen (außer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadenshöhe ausschließlich auf Basis der CVSS Impact Matrix. Der Maximalwert für diese Produkte ist "HIGH" für "Confidentiality", "Integrity" und "Availability" über alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert "HOCH" für die Schadenshöhe.

Known affected: 4 products

Open the full advisory

WID-SEC-W-2023-1017

Vulnerability from csaf_certbund - Published: 2023-04-18 22:00 - Updated: 2023-04-18 22:00

Summary

Oracle Financial Services Applications: Mehrere Schwachstellen

Severity

Hoch

Scope

38 vulnerabilities in this advisory, including CVE-2022-46908.

CVE-2022-46908

In Oracle Financial Services Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrität und Verfügbarkeit gefährden. Für die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle veröffentlicht keine weiteren Details zu diesen Schwachstellen (außer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadenshöhe ausschließlich auf Basis der CVSS Impact Matrix. Der Maximalwert für diese Produkte ist "HIGH" für "Confidentiality", "Integrity" und "Availability" über alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert "HOCH" für die Schadenshöhe.

Known affected: 49 products Last affected: 1 product

Open the full advisory

WID-SEC-W-2023-1022

Vulnerability from csaf_certbund - Published: 2023-04-18 22:00 - Updated: 2023-04-18 22:00

Summary

Oracle Communications Applications: Mehrere Schwachstellen

Severity

Hoch

Scope

15 vulnerabilities in this advisory, including CVE-2022-46908.

CVE-2022-46908

In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrität und Verfügbarkeit gefährden. Für die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle veröffentlicht keine weiteren Details zu diesen Schwachstellen (außer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadenshöhe ausschließlich auf Basis der CVSS Impact Matrix. Der Maximalwert für diese Produkte ist "HIGH" für "Confidentiality", "Integrity" und "Availability" über alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert "HOCH" für die Schadenshöhe.

Known affected: 5 products Last affected: 6 products

Open the full advisory

WID-SEC-W-2023-1614

Vulnerability from csaf_certbund - Published: 2023-06-29 22:00 - Updated: 2023-10-25 22:00

Summary

Tenable Security Nessus Network Monitor: Mehrere Schwachstellen

Severity

Hoch

Scope

173 vulnerabilities in this advisory, including CVE-2022-46908.

CVE-2022-46908

In Tenable Security Nessus Network Monitor existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in Komponenten von Drittanbietern wie c-ares, curl, libbzip2, libpcre, libxml2, sqlite und OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erhöhte Rechte.

Open the full advisory

WID-SEC-W-2023-1728

Vulnerability from csaf_certbund - Published: 2023-07-11 22:00 - Updated: 2023-07-11 22:00

Summary

Autodesk AutoCAD: Mehrere Schwachstellen

Severity

Hoch

Scope

19 vulnerabilities in this advisory, including CVE-2022-46908.

CVE-2022-46908

In Autodesk AutoCAD bestehen mehrere Schwachstellen in Komponenten von Drittanbietern. Betroffen sind unter anderem "cURL", "Expat", "SQLite" sowie "Zlib". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, Dateien zu manipulieren oder Informationen offenzulegen.

Open the full advisory

WID-SEC-W-2023-2031

Vulnerability from csaf_certbund - Published: 2023-08-09 22:00 - Updated: 2025-10-19 22:00

Summary

Xerox FreeFlow Print Server: Mehrere Schwachstellen

Severity

Hoch

Scope

243 vulnerabilities in this advisory, including CVE-2022-46908.

CVE-2022-46908

Known affected: 6 products

Open the full advisory

WID-SEC-W-2024-0119

Vulnerability from csaf_certbund - Published: 2024-01-16 23:00 - Updated: 2024-11-21 23:00

Summary

Oracle MySQL: Mehrere Schwachstellen

Severity

Hoch

Scope

33 vulnerabilities in this advisory, including CVE-2022-46908.

CVE-2022-46908

In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrität und Verfügbarkeit gefährden. Für die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle veröffentlicht keine weiteren Details zu diesen Schwachstellen (außer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadenshöhe ausschließlich auf Basis der CVSS Impact Matrix. Der Maximalwert für diese Produkte ist "HIGH" für "Confidentiality", "Integrity" und "Availability" über alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert "HOCH" für die Schadenshöhe.

Known affected: 11 products Last affected: 6 products

Open the full advisory

WID-SEC-W-2024-0794

Vulnerability from csaf_certbund - Published: 2024-04-04 22:00 - Updated: 2026-01-22 23:00

Summary

Dell ECS: Mehrere Schwachstellen

Severity

Hoch

Scope

598 vulnerabilities in this advisory, including CVE-2022-46908.

CVE-2022-46908

Known affected: 2 products

Open the full advisory

WID-SEC-W-2025-1459

Vulnerability from csaf_certbund - Published: 2025-07-03 22:00 - Updated: 2025-07-03 22:00

Summary

Dell Data Protection Advisor: Mehrere Schwachstellen

Severity

Hoch

Scope

57 vulnerabilities in this advisory, including CVE-2022-46908.

CVE-2022-46908

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-46908 (GCVE-0-2022-46908)

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour