6.5
CVE-2019-18229
- EPSS 2.4%
- Veröffentlicht 31.10.2019 22:15:11
- Zuletzt bearbeitet 21.11.2024 04:32:53
- Quelle ics-cert@hq.dhs.gov
- CVE-Watchlists
- Unerledigt
LoginAdvantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage these vulnerabilities to disclose information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Advantech ≫ Wise-paas/rmm Version <= 3.3.29
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.4% | 0.819 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:P/I:N/A:N
|
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
https://www.us-cert.gov/ics/advisories/icsa-19-304-01
https://www.zerodayinitiative.com/advisories/ZDI-19-937/
https://www.zerodayinitiative.com/advisories/ZDI-19-938/
https://www.zerodayinitiative.com/advisories/ZDI-19-940/
https://www.zerodayinitiative.com/advisories/ZDI-19-948/
https://www.zerodayinitiative.com/advisories/ZDI-19-949/
https://www.zerodayinitiative.com/advisories/ZDI-19-951/
https://www.zerodayinitiative.com/advisories/ZDI-19-952/
https://www.zerodayinitiative.com/advisories/ZDI-19-955/
https://www.zerodayinitiative.com/advisories/ZDI-19-956/
https://www.zerodayinitiative.com/advisories/ZDI-19-957/