CVE-2020-14982

{"id": "CVE-2020-14982", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-07-15T21:15:12.380", "references": [{"url": "https://www.mindpointgroup.com/articles/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.mindpointgroup.com/blog/webta-sqli-vulnerability/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.mindpointgroup.com/articles/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mindpointgroup.com/blog/webta-sqli-vulnerability/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 (affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter) allows an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database."}, {"lang": "es", "value": "Una vulnerabilidad de Inyecci\u00f3n SQL Ciega en Kronos WebTA versiones 3.8.x y posteriores a 4.0, (que afecta el par\u00e1metro SortBy del servlet com.threeis.webta.H352premPayRequest) permite a un atacante con el rol de Empleado, Supervisor o Cronometrador leer datos confidenciales de la base de datos"}], "lastModified": "2024-11-21T05:04:34.583", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kronos:web_time_and_attendance:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3400EE4B-5B36-4C46-A208-807129645AD6", "versionEndExcluding": "4.0", "versionStartIncluding": "3.8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}