CVE-2024-9968

WebEIP v3.0 from NewType does not properly validate user input, allowing remote attackers with regular privilege to inject SQL commands to read, modify, and delete data stored in database. The affected product is no longer maintained. It is recommended to upgrade to the new product.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.twcert.org.tw/en/cp-139-8133-2cc3a-2.html	Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-8132-160bb-1.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:newtype:webeip:3.0:*:*:*:*:*:*:*

History

19 Oct 2024, 00:42

Type	Values Removed	Values Added
First Time		Newtype Newtype webeip
References	~~() https://www.twcert.org.tw/en/cp-139-8133-2cc3a-2.html -~~	() https://www.twcert.org.tw/en/cp-139-8133-2cc3a-2.html - Third Party Advisory
References	~~() https://www.twcert.org.tw/tw/cp-132-8132-160bb-1.html -~~	() https://www.twcert.org.tw/tw/cp-132-8132-160bb-1.html - Third Party Advisory
CPE		cpe:2.3:a:newtype:webeip:3.0:::::::*

15 Oct 2024, 12:57

Type	Values Removed	Values Added
Summary		(es) WebEIP v3.0 de NewType no valida correctamente la entrada del usuario, lo que permite a atacantes remotos con privilegios normales inyectar comandos SQL para leer, modificar y eliminar datos almacenados en la base de datos. El producto afectado ya no recibe mantenimiento. Se recomienda actualizar al nuevo producto.

15 Oct 2024, 03:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-15 03:15

Updated : 2024-10-19 00:42

NVD link : CVE-2024-9968

Mitre link : CVE-2024-9968

CVE.ORG link : CVE-2024-9968

JSON object : View

Products Affected

newtype

webeip

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-9968", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "twcert@cert.org.tw"}], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-10-15T03:15:02.360", "references": [{"url": "https://www.twcert.org.tw/en/cp-139-8133-2cc3a-2.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-8132-160bb-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "WebEIP v3.0 from \n\nNewType\u00a0does not properly validate user input, allowing remote attackers with regular privilege to inject SQL commands to read, modify, and delete data stored in database. The affected product is no longer maintained. It is recommended to upgrade to the new product."}, {"lang": "es", "value": "WebEIP v3.0 de NewType no valida correctamente la entrada del usuario, lo que permite a atacantes remotos con privilegios normales inyectar comandos SQL para leer, modificar y eliminar datos almacenados en la base de datos. El producto afectado ya no recibe mantenimiento. Se recomienda actualizar al nuevo producto."}], "lastModified": "2024-10-19T00:42:13.957", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:newtype:webeip:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "647F475F-A3F3-476D-AC43-20C71E930735"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}