Lucene search

[email protected]CVE-2020-8592

HistoryFeb 03, 2020 - 9:15 p.m.

CVE-2020-8592

2020-02-0321:15:11

CWE-89

[email protected]

web.nvd.nist.gov

eg manager

7.1.2

sql injection

user parameter

forgot password

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.5%

JSON

eG Manager 7.1.2 allows SQL Injection via the user parameter to com.eg.LoginHelperServlet (aka the Forgot Password feature).

Affected configurations

NVD

Node

eginnovationseg_managerMatch7.1.2

CPENameOperatorVersion
eginnovations:eg_managereginnovations eg managereq7.1.2

CPE	Name	Operator	Version
eginnovations:eg_manager	eginnovations eg manager	eq	7.1.2

References

pyaefromucsp.blogspot.com/2020/02/eg-manager-v712-sql-injection-lead-to_56.html

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.5%

JSON

Related for CVE-2020-8592

cvelist1 prion1 nvd1