Lucene search
HistoryNov 23, 2004 - 5:00 a.m.
CVE-2004-0272
cve-2004-0272
sql injection
maxwebportal
remote attackers
arbitrary sql code
sensitive information
sendto parameter
personal messages
nvd
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.9 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
67.9%
SQL injection vulnerability in MaxWebPortal allows remote attackers to inject arbitrary SQL code and gain sensitive information via the SendTo parameter in Personal Messages.
Affected configurations
Node
maxwebportalmaxwebportalMatch1.30
ORmaxwebportalmaxwebportalMatch1.31
| CPE | Name | Operator | Version |
|---|---|---|---|
| maxwebportal:maxwebportal | maxwebportal | eq | 1.30 |
| maxwebportal:maxwebportal | maxwebportal | eq | 1.31 |
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.9 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
67.9%
Related for CVE-2004-0272