Mindbreeze InSpire Vulnerabilities
This page lists known security vulnerabilities found in Mindbreeze InSpire. The article titles contain the Mindbreeze issue number and, in the case of third-party software, the official CVE number. Information about the affected components, severity level, current status and how to prevent the issue as well as hotfix information if applicable, can be found on the detail pages. You can also use the full text search to find specific vulnerabilities.
If you have found a possible security vulnerability, please contact Mindbreeze InSpire Support at support@mindbreeze.com providing detailed information about the problem found.
Vulnerabilities
ID: MINDBREEZE23683
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 7.6 High
Status: Final
First published: August 31, 2022
Summary
Possible SQL injection with special api.v2.search requests.
Remediation
Update to at least 22.1 Hotfix 2 or disable the task "Update app.telemetry dashboards".
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
ID: MINDBREEZE23311
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 6.8 Medium
Status: Final
First published: October 20, 2023
CVEs: CVE-2022-1438, CVE-2022-3916, CVE-2023-0264
ID: MINDBREEZE23309
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 5.3 Medium
Status: Final
First published: September 28, 2022
CVEs: CVE-2022-21496
Summary
OpenJDK Security Update 8u333 contains fixes for the following CVEs:
OpenJDK: URI parsing inconsistencies (JNDI, 8278972) (CVE-2022-21496)
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
ID: MINDBREEZE23118
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 5.6 Medium
Status: Final
First published: September 28, 2022
CVEs: CVE-2022-29901
Summary
BZ#2103148 CVE-2022-29901 hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions.
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
Mindbreeze InSpire 22.2 Release (Version 22.2.0.729)
ID: MINDBREEZE22857
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 6.5 Medium
Status: Final
First published: January 25, 2023
CVEs: CVE-2021-41182, CVE-2021-41183, CVE-2021-41184
Summary
This vulnerability may allow running cross-site scripting (XSS) attacks due to improper jQuery method.
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
Mindbreeze InSpire 22.3 Release (Version 22.3.0.1109)
ID: MINDBREEZE22842
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 7.5 Medium
Status: Final
First published: June 29, 2022
CVEs: CVE-2022-24785
Summary
CVE-2022-24785 Moment.js: Path traversal in moment.locale
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
Mindbreeze InSpire 22.1 Release (Version 22.1.0.1309)
Mindbreeze InSpire SaaS 22.1 Release (Version 22.1.0.1309)
ID: MINDBREEZE22124
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 7.5 High
Status: Final
First published: September 28, 2022
CVEs: CVE-2017-18214
Summary
The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
ID: MINDBREEZE21682
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 7.8 High
Status: Final
First published: June 29, 2022
CVEs: CVE-2022-0185
Summary
CVE-2022-0185 kernel: fs_context: heap overflow in legacy parameter handling.
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
Mindbreeze InSpire 22.1 Release (Version 22.1.0.1309)
ID: MINDBREEZE21528
Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS
Severity: 7.8 High
Status: Final
First published: March 16, 2022
CVEs: CVE-2021-4034
Summary
A local privilege escalation vulnerability was found on polkit's pkexec utility.
Hotfix Information
Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
Mindbreeze InSpire 21.3 Release Hotfix 4 (Version 21.3.5.1708)
ID: MINDBREEZE21044
Affected Components: None
Severity: 6.8 Moderate
Status: Final
First published: December 16, 2021
CVEs: CVE-2021-44228