PatchTheCVEarchery vulnerabilities and fixes
Recent CVEs affecting archery, with upgrade or downgrade steps. 16 tracked.
archery has 16 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 7. Most recent: 2023-11-16. Highest priority: CVE-2022-38541 (score 61/100).
- CVE-2023-48053 HIGH 7.5 DOWNGRADE Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption
- CVE-2023-30605 MEDIUM 6.5 DOWNGRADE Archery is an open source SQL audit platform
- CVE-2023-30558 MEDIUM 6.5 DOWNGRADE Archery is an open source SQL audit platform
- CVE-2023-30557 MEDIUM 6.5 DOWNGRADE Archery is an open source SQL audit platform
- CVE-2023-30556 MEDIUM 6.5 DOWNGRADE Archery is an open source SQL audit platform
- CVE-2023-30555 MEDIUM 6.5 DOWNGRADE Archery is an open source SQL audit platform
- CVE-2023-30554 MEDIUM 6.5 DOWNGRADE Archery is an open source SQL audit platform
- CVE-2023-30553 MEDIUM 6.5 DOWNGRADE Archery is an open source SQL audit platform
- CVE-2023-30552 MEDIUM 6.5 DOWNGRADE Archery is an open source SQL audit platform
- CVE-2022-38542 CRITICAL 9.8 UPGRADE Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter i
- CVE-2022-38541 CRITICAL 9.8 UPGRADE Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time a
- CVE-2022-38540 CRITICAL 9.8 UPGRADE Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter i
- CVE-2022-38539 CRITICAL 9.8 UPGRADE Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /a
- CVE-2022-38538 CRITICAL 9.8 UPGRADE Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in
- CVE-2022-38537 CRITICAL 9.8 UPGRADE Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file,
- CVE-2019-20008 MEDIUM 5.4 UPGRADE In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editi
FAQ
How do I fix archery vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is archery being exploited right now?
None of the tracked archery CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which archery CVE should I patch first?
CVE-2022-38541 currently ranks highest (61/100): Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time a.