PT-2020-13851
CVE-2020-14027
·
تاريخ النشر
2020-09-22
·
تاريخ التحديث
2020-09-26
الوصف من
CVSS 3.1
5.3
متوسطةالمقاييسAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Ozeki NG SMS Gateway versions prior to 4.17.7
Description
An issue was discovered where the database connection strings in Ozeki NG SMS Gateway accept custom unsafe arguments, such as
ENABLE LOCAL INFILE, which can be used by attackers to enable MySQL Load Data Local attacks, potentially allowing a rogue MySQL server to be used.Recommendations
For Ozeki NG SMS Gateway versions prior to 4.17.7, update to version 4.17.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of custom database connection string arguments to prevent exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾