CVE-2019-12465

{"id": "CVE-2019-12465", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2019-09-09T14:15:11.990", "references": [{"url": "https://www.darkmatter.ae/xen1thlabs/librenms-sql-injection-vulnerability-xl-19-024/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.darkmatter.ae/xen1thlabs/librenms-sql-injection-vulnerability-xl-19-024/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajax_rulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajax_rulesuggest.php?debug=1&term= request."}, {"lang": "es", "value": "Se detect\u00f3 un problema en LibreNMS versi\u00f3n 1.50.1. Se identific\u00f3 un fallo de inyecci\u00f3n SQL en el archivo ajax_rulesuggest.php donde el par\u00e1metro term es usado de forma no segura en una consulta de base de datos para mostrar columnas de una tabla, como es demostrado por una petici\u00f3n ajax_rulesuggest.php?debug=1&term= ."}], "lastModified": "2024-11-21T04:22:54.570", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD0EDCF7-4B65-4BBF-B1F1-53FFFF1D8ED0", "versionEndExcluding": "1.53"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}