PT-2023-21484 · Ibm · Bigfix Webui Api App
CVE-2023-28019
·
Publicado
2023-07-18
·
Atualizado
2023-07-27
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Bigfix WebUI API App versions prior to 14
Description
The issue is related to insufficient validation, allowing an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.
Recommendations
For versions prior to 14, update to version 14 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebUI API to minimize the risk of exploitation. Avoid using unparameterized SQL queries in the affected API until the issue is resolved.
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Bigfix Webui Api App