PT-2016-5125

CVE-2016-2346

Publicado

2016-04-25

Atualizado

2016-05-04

Descrição por

CVSS 3.1

8.1

Alta

MétricasAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Allround Automations PL/SQL Developer version 11.0.6 and earlier, specifically versions prior to 11.0.6

Description The issue allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream, as the software relies on unverified HTTP data for updates.

Recommendations For versions prior to 11.0.6, update to version 11.0.6 or later to resolve the issue.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Adam Caudill

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-345: Insufficient Verification of Data Authenticity

Identificadores relacionados