Mindbreeze InSpire Vulnerabilities
This page lists known security vulnerabilities found in Mindbreeze InSpire. The article titles contain the Mindbreeze issue number and, in the case of third-party software, the official CVE number. Information about the affected components, severity level, current status and how to prevent the issue as well as hotfix information if applicable, can be found on the detail pages. You can also use the full text search to find specific vulnerabilities.
If you have found a possible security vulnerability, please contact Mindbreeze InSpire Support at support@mindbreeze.com providing detailed information about the problem found.
Vulnerabilities
ID: MINDBREEZE26358
Affected Components: Mindbreeze InSpire, Mindbreeze InSpire SaaS
Severity: 7.5 Important
Status: Final
First published: March 15, 2023
CVE: CVE-2022-23491
Summary
Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware.
Hotfix Information
ID: MINDBREEZE25529
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 5.3 Medium
Status: Final
First published: January 25, 2023
CVEs: CVE-2022-21626, CVE-2022-21624, CVE-2022-21619
ID: MINDBREEZE25399
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 6.1 Medium
Status: Final
First published: January 25, 2023
CVEs: CVE-2022-31160
Summary
This vulnerability may allow running cross-site scripting (XSS) attacks due to improper jQuery _getCreateOptions method.
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
Mindbreeze InSpire 22.3 Release (Version 22.3.0.1109)
ID: MINDBREEZE25384
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 7.5 High
Status: Final
First published: November 30, 2022
CVEs: CVE-2022-3786, CVE-2022-3602, CVE-2022-3435
Summary
OpenSSL: X.509 Email Address Buffer Overflow (CVE-2022-3602)
OpenSSL: X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)
kernel: Out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)
Hotfix Information
ID: MINDBREEZE23683
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 7.6 High
Status: Final
First published: August 31, 2022
Summary
Possible SQL injection with special api.v2.search requests.
Remediation
Update to at least 22.1 Hotfix 2 or disable the task "Update app.telemetry dashboards".
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
ID: MINDBREEZE23311
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 6.8 Medium
Status: Final
First published: October 20, 2023
CVEs: CVE-2022-1438, CVE-2022-3916, CVE-2023-0264
ID: MINDBREEZE23309
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 5.3 Medium
Status: Final
First published: September 28, 2022
CVEs: CVE-2022-21496
Summary
OpenJDK Security Update 8u333 contains fixes for the following CVEs:
OpenJDK: URI parsing inconsistencies (JNDI, 8278972) (CVE-2022-21496)
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
ID: MINDBREEZE23118
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 5.6 Medium
Status: Final
First published: September 28, 2022
CVEs: CVE-2022-29901
Summary
BZ#2103148 CVE-2022-29901 hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions.
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
Mindbreeze InSpire 22.2 Release (Version 22.2.0.729)
ID: MINDBREEZE22857
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 6.5 Medium
Status: Final
First published: January 25, 2023
CVEs: CVE-2021-41182, CVE-2021-41183, CVE-2021-41184
Summary
This vulnerability may allow running cross-site scripting (XSS) attacks due to improper jQuery method.
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
Mindbreeze InSpire 22.3 Release (Version 22.3.0.1109)
ID: MINDBREEZE22842
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 7.5 Medium
Status: Final
First published: June 29, 2022
CVEs: CVE-2022-24785
Summary
CVE-2022-24785 Moment.js: Path traversal in moment.locale
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
Mindbreeze InSpire 22.1 Release (Version 22.1.0.1309)
Mindbreeze InSpire SaaS 22.1 Release (Version 22.1.0.1309)