Lucene search

[email protected]CVE-2019-12149

HistoryJun 11, 2019 - 10:29 p.m.

CVE-2019-12149

2019-06-1122:29:06

CWE-89

[email protected]

web.nvd.nist.gov

cve-2019-12149

sql injection

silverstripe

restfulserver

registry

vulnerability

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

49.6%

JSON

SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry module 2.1.x before 2.1.1 and 2.2.x before 2.2.1 allows attackers to execute arbitrary SQL commands.

Affected configurations

NVD

Node

silverstriperegistryRange2.1.0–2.1.1silverstripe

silverstriperegistryRange2.2.0–2.2.1silverstripe

silverstriperestfulserverRange1.0.1–1.0.9silverstripe

silverstriperestfulserverRange2.0.0–2.0.4silverstripe

CPENameOperatorVersion
silverstripe:registrysilverstripe registrylt2.1.1
silverstripe:registrysilverstripe registrylt2.2.1
silverstripe:restfulserversilverstripe restfulserverlt1.0.9
silverstripe:restfulserversilverstripe restfulserverlt2.0.4

CPE	Name	Operator	Version
silverstripe:registry	silverstripe registry	lt	2.1.1
silverstripe:registry	silverstripe registry	lt	2.2.1
silverstripe:restfulserver	silverstripe restfulserver	lt	1.0.9
silverstripe:restfulserver	silverstripe restfulserver	lt	2.0.4