Lucene search

GitHub_MCVELIST:CVE-2020-11004

HistoryApr 24, 2020 - 8:25 p.m.

CVE-2020-11004 SQL Injection in Admidio

2020-04-2420:25:14

CWE-89

GitHub_M

www.cve.org

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

0.002 Low

EPSS

Percentile

57.3%

JSON

SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13.

CNA Affected

[
  {
    "product": "admidio",
    "vendor": "Admidio",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.3.13"
      }
    ]
  }
]

References

github.com/Admidio/admidio/commit/ea5d6f114b151ed11ec0ad7cb47bd729e77a874a

github.com/Admidio/admidio/issues/908

github.com/Admidio/admidio/security/advisories/GHSA-qh57-rcff-gx54

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

0.002 Low

EPSS

Percentile

57.3%

JSON

Related for CVELIST:CVE-2020-11004