Lucene search

VulDBCVELIST:CVE-2015-10053

HistoryJan 16, 2023 - 11:58 a.m.

CVE-2015-10053 prodigasistemas curupira passwords_controller.rb sql injection

2023-01-1611:58:03

CWE-89

VulDB

www.cve.org

vulnerability

prodigasistemas curupira

passwords_controller.rb

sql injection

upgrading

patch

vdb-218394

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

5.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

Confidence

High

EPSS

0.002

Percentile

51.8%

JSON

A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The patch is identified as 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.

CNA Affected

[
  {
    "vendor": "prodigasistemas",
    "product": "curupira",
    "versions": [
      {
        "version": "0.1.0",
        "status": "affected"
      },
      {
        "version": "0.1.1",
        "status": "affected"
      },
      {
        "version": "0.1.2",
        "status": "affected"
      },
      {
        "version": "0.1.3",
        "status": "affected"
      }
    ]
  }
]

References

github.com/prodigasistemas/curupira/commit/93a9a77896bb66c949acb8e64bceafc74bc8c271

github.com/prodigasistemas/curupira/releases/tag/v0.1.4

vuldb.com/?ctiid.218394

vuldb.com/?id.218394

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

5.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

Confidence

High

EPSS

0.002

Percentile

51.8%

JSON

Related for CVELIST:CVE-2015-10053