Vulnerability record · CVE-2022-22149 · published 14 April 2022
CVE-2022-22149: Lansweeper HelpdeskEmailActions.aspx SQL injection
Lansweeper · Lansweeper
Lansweeper 9.1.20.2 contains a SQL injection flaw in the HelpdeskEmailActions.aspx functionality. A crafted HTTP request can inject SQL, allowing an authenticated attacker to read or modify the backend database. The record does not list affected versions beyond the one named.
Description
A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityHigh CVSS (8.8) with a very high EPSS and public exploit detail, though it requires authentication and is not in KEV.
What it is
Lansweeper 9.1.20.2 contains a SQL injection flaw in the HelpdeskEmailActions.aspx functionality. A crafted HTTP request can inject SQL, allowing an authenticated attacker to read or modify the backend database. The record does not list affected versions beyond the one named.
Impact
An attacker with a valid account can execute arbitrary SQL against the Lansweeper database, leading to data disclosure, modification, or deletion. The CVSS vector rates confidentiality, integrity, and availability impact as high.
Attack surface
Reachable over the network via HTTP requests to HelpdeskEmailActions.aspx. Authentication is required (PR:L) and no user interaction is needed (UI:N).
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is very high (0.726, 99.4th percentile) and the Talos reference is tagged Exploit, indicating public exploit detail exists.
What to do
- Upgrade Lansweeper to a version that fixes the HelpdeskEmailActions.aspx SQL injection, per the vendor changelog.
- Restrict network access to the Lansweeper web interface to trusted management networks.
- Review and minimize accounts with helpdesk/email action privileges.
- Apply parameterized queries or input validation if any custom integration touches this endpoint.
- Monitor the vendor advisory and changelog for the exact fixed release.
Detection
- Inspect web logs for suspicious requests to HelpdeskEmailActions.aspx containing SQL metacharacters or UNION/OR patterns.
- Alert on unusual database queries or errors originating from the Lansweeper web application.
- Baseline normal helpdesk email action traffic and flag deviations in parameter values or request volume.
- Correlate authenticated sessions performing atypical database reads or writes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://talosintelligence.com/vulnerability_reports/TALOS-2022-1441 | ExploitThird Party Advisory |
| https://www.lansweeper.com/changelog/ | Release NotesVendor Advisory |
| https://talosintelligence.com/vulnerability_reports/TALOS-2022-1441 | ExploitThird Party Advisory |
| https://www.lansweeper.com/changelog/ | Release NotesVendor Advisory |
Track CVE-2022-22149 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-22149), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
