Lucene search

Veracode Vulnerability DatabaseVERACODE:46404

HistoryApr 15, 2024 - 6:45 a.m.

SQL Injection

2024-04-1506:45:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sql injection

mautic

reports bundle

improper sanitization

user-supplied input

sensitive data

database permissions

file systems

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

mautic/core is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of user-supplied input within the Reports bundle. An attacker can retrieve and alter sensitive data, including login credentials, and depending on database permissions, manipulate file systems by injecting SQL commands.

References

github.com/advisories/GHSA-jj6w-2cqg-7p94

github.com/mautic/mautic/commit/cab65e0acc4f23c4f07c117dee1b69dac5abed3f

github.com/mautic/mautic/commit/e75b1eea16309588f069169b5882cf53f854dbd8

github.com/mautic/mautic/security/advisories/GHSA-jj6w-2cqg-7p94

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

Related for VERACODE:46404