CVE-2010-2635

SQL injection vulnerability in IBM WebSphere Commerce 6.0 before 6.0.0.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters to "Commerce Organization Admin Console JavaServer pages."

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ73130
https://exchange.xforce.ibmcloud.com/vulnerabilities/62951
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ73130
https://exchange.xforce.ibmcloud.com/vulnerabilities/62951

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:websphere_commerce:6.0.0.1:::::::*
	cpe:2.3:a:ibm:websphere_commerce:6.0.0.2:::::::*
	cpe:2.3:a:ibm:websphere_commerce:6.0.0.3:::::::*
	cpe:2.3:a:ibm:websphere_commerce:6.0.0.4:::::::*
	cpe:2.3:a:ibm:websphere_commerce:6.0.0.5:::::::*
	cpe:2.3:a:ibm:websphere_commerce:6.0.0.6:::::::*
	cpe:2.3:a:ibm:websphere_commerce:6.0.0.7:::::::*
	cpe:2.3:a:ibm:websphere_commerce:6.0.0.8:::::::*
	cpe:2.3:a:ibm:websphere_commerce:6.0.0.9:::::::*

History

21 Nov 2024, 01:17

Type	Values Removed	Values Added
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg1IZ73130 -~~	() http://www-01.ibm.com/support/docview.wss?uid=swg1IZ73130 -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/62951 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/62951 -

Information

Published : 2010-11-09 21:00

Updated : 2024-11-21 01:17

NVD link : CVE-2010-2635

Mitre link : CVE-2010-2635

CVE.ORG link : CVE-2010-2635

JSON object : View

Products Affected

ibm

websphere_commerce

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2010-2635", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-11-09T21:00:02.913", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IZ73130", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62951", "source": "cve@mitre.org"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IZ73130", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62951", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in IBM WebSphere Commerce 6.0 before 6.0.0.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters to \"Commerce Organization Admin Console JavaServer pages.\""}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en IBM WebSphere Commerce 6.0 anterior v6.0.0.10 permite a usuarios autenticados remotamente ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s de par\u00e1metros no especificados en \"p\u00e1ginas Commerce Organization Admin Console JavaServer .\""}], "lastModified": "2024-11-21T01:17:03.333", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C21677D0-CF4E-4958-83A7-EF8C3AF4B1D1"}, {"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAF24659-1284-4762-925C-4879B56AC386"}, {"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "162FF755-CFF5-4AF2-B5D4-AEBA107DD93D"}, {"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4783F5D2-0709-4E5B-B6B7-DF7823E928CB"}, {"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EB6E277-36B8-483E-8F9E-34D350BBB0EE"}, {"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40A7EA48-BCC0-41BD-975D-0C01B6066BE7"}, {"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA2AE738-BC94-4731-B6C3-54F808756ABC"}, {"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE23443C-6FB5-43AC-9822-1267AE61D14E"}, {"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5952ADD8-4D62-401A-A5D3-1A63706D2F36"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}