PT-2020-20226
CVE-2020-8592
·
تاريخ النشر
2020-02-03
·
تاريخ التحديث
2020-02-05
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
eG Manager version 7.1.2
Description
The issue allows SQL Injection via the
user parameter to the com.eg.LoginHelperServlet, which is part of the Forgot Password feature.Recommendations
For eG Manager version 7.1.2, consider restricting access to the
com.eg.LoginHelperServlet until a patch is available. Avoid using the user parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾