Lucene search

MitreCVE-2021-36432

HistoryFeb 03, 2023 - 6:15 p.m.

CVE-2021-36432

2023-02-0318:15:09

CWE-89

mitre

web.nvd.nist.gov

cve-2021-36432

sql injection

jocms 0.8

remote attackers

arbitrary sql commands

sensivie information

jo_set_mask() function

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.8

Confidence

High

EPSS

0.002

Percentile

52.9%

JSON

SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_set_mask() function in jocms/apps/mask/mask.php.

Affected configurations

Nvd

Node

jocms_projectjocmsMatch0.8

VendorProductVersionCPE
jocms_projectjocms0.8cpe:2.3:a:jocms_project:jocms:0.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
jocms_project	jocms	0.8	cpe:2.3:a:jocms_project:jocms:0.8:::::::*

References

github.com/mxgbr/jocms/issues/6

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.8

Confidence

High

EPSS

0.002

Percentile

52.9%

JSON

Related for CVE-2021-36432