CVE-2019-5278

{"id": "CVE-2019-5278", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-12-13T22:15:11.747", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-gauss100-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}, {"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-gauss100-en", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database in CampusInsight before V100R019C00SPC200. Attackers who gain the specific permission can use this vulnerability by sending elaborate SQL statements to the database. Successful exploit of this vulnerability may cause the database to crash."}, {"lang": "es", "value": "Hay una vulnerabilidad de lectura fuera de l\u00edmites en la funcionalidad Advanced Packages de la base de datos Gauss100 OLTP en CampusInsight versiones anteriores a la versi\u00f3n V100R019C00SPC200. Los atacantes que consiguen el permiso espec\u00edfico pueden usar esta vulnerabilidad mediante el env\u00edo de sentencias SQL especialmente dise\u00f1adas hacia la base de datos. La explotaci\u00f3n con \u00e9xito de esta vulnerabilidad puede causar que la base de datos se bloquee."}], "lastModified": "2024-11-21T04:44:39.543", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:huawei:campusinsight:v100r019c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3275FDEA-1A36-42CD-A76A-710A070F3E74"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@huawei.com"}