CVE-2020-8967

There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information.

CVSS v3 10.0 CRITICAL
CVSS v2.0 7.5 HIGH

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability	Third Party Advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gesio:erp:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:39

Type	Values Removed	Values Added
CVSS	v2 : ~~7.5~~ v3 : ~~9.8~~	v2 : 7.5 v3 : 10.0
References	~~() https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability - Third Party Advisory~~	() https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability - Third Party Advisory

Information

Published : 2020-06-01 14:15

Updated : 2024-11-21 05:39

NVD link : CVE-2020-8967

Mitre link : CVE-2020-8967

CVE.ORG link : CVE-2020-8967

JSON object : View

Products Affected

gesio

erp

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2020-8967", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-06-01T14:15:10.647", "references": [{"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}, {"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de Neutralizaci\u00f3n inapropiada de Elementos Especiales usados en un comando SQL (SQL Injection) en los archivos php de GESIO ERP. GESIO ERP todas las versiones anteriores a 11.2, permite a usuarios maliciosos recuperar toda la informaci\u00f3n de la base de datos."}], "lastModified": "2024-11-21T05:39:45.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gesio:erp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F66BF65-DD4A-4F02-A2BC-6DD4FEAE441D", "versionEndExcluding": "11.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@incibe.es"}