CVE-2019-5278

There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database in CampusInsight before V100R019C00SPC200. Attackers who gain the specific permission can use this vulnerability by sending elaborate SQL statements to the database. Successful exploit of this vulnerability may cause the database to crash.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-gauss100-en	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:huawei:campusinsight:v100r019c00:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-12-13 22:15

Updated : 2024-02-28 17:28

NVD link : CVE-2019-5278

Mitre link : CVE-2019-5278

CVE.ORG link : CVE-2019-5278

JSON object : View

Products Affected

huawei

campusinsight

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2019-5278", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-12-13T22:15:11.747", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-gauss100-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database in CampusInsight before V100R019C00SPC200. Attackers who gain the specific permission can use this vulnerability by sending elaborate SQL statements to the database. Successful exploit of this vulnerability may cause the database to crash."}, {"lang": "es", "value": "Hay una vulnerabilidad de lectura fuera de l\u00edmites en la funcionalidad Advanced Packages de la base de datos Gauss100 OLTP en CampusInsight versiones anteriores a la versi\u00f3n V100R019C00SPC200. Los atacantes que consiguen el permiso espec\u00edfico pueden usar esta vulnerabilidad mediante el env\u00edo de sentencias SQL especialmente dise\u00f1adas hacia la base de datos. La explotaci\u00f3n con \u00e9xito de esta vulnerabilidad puede causar que la base de datos se bloquee."}], "lastModified": "2019-12-19T20:23:44.997", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:huawei:campusinsight:v100r019c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3275FDEA-1A36-42CD-A76A-710A070F3E74"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@huawei.com"}