PT-2019-15564

CVE-2019-18663

Publicado

2019-11-04

Atualizado

2019-11-05

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ARP-GUARD version 4.0.0-5

Description A SQL injection issue allows unauthenticated remote attackers to execute arbitrary SQL commands. This is achieved via the user id parameter in a "/login/forgot1" POST request.

Recommendations For ARP-GUARD version 4.0.0-5, avoid using the user id parameter in the "/login/forgot1" API endpoint until the issue is resolved. As a temporary workaround, consider restricting access to this endpoint to minimize the risk of exploitation.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Pascal Keul

Patrick Muench

Torsten Löbner

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')