Lucene search

[email protected]CVE-2021-3262

HistoryAug 29, 2023 - 8:15 p.m.

CVE-2021-3262

2023-08-2920:15:09

CWE-89

[email protected]

web.nvd.nist.gov

cve-2021-3262

tripspark

veo transportation

novusedu

sql injection

server-side logic

data inputs

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.9%

JSON

TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body parameters from end users without sanitizing using server-side logic. It was possible to inject custom SQL commands into the “Student Busing Information” search queries.

Affected configurations

NVD

Node

trisparknovuseduMatch2.2.x-xp_bb-20201123-184084

trisparkveo_transportationMatch2.2.x-xp_bb-20201123-184084os

CPENameOperatorVersion
trispark:novusedutrispark novusedueq2.2.x-xp_bb-20201123-184084
trispark:veo_transportationtrispark veo transportationeq2.2.x-xp_bb-20201123-184084os

CPE	Name	Operator	Version
trispark:novusedu	trispark novusedu	eq	2.2.x-xp_bb-20201123-184084
trispark:veo_transportation	trispark veo transportation	eq	2.2.x-xp_bb-20201123-184084os

References

tripspark.com

veo.com

susos.co/blog/f/cve-disclosureuncovered-sql-injection-in-tripspark-veo-transport

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.9%

JSON

Related for CVE-2021-3262

cvelist1 prion1 nvd1