Imagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. A low-privileged user could inject a SQL statement through the "Export to CSV" feature of the Contact Manager web GUI.
References
Configurations
History
21 Nov 2024, 06:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Imagicle/CVE - Third Party Advisory | |
| References | () https://www.imagicle.com/en/resources/download/ - Vendor Advisory | |
| References | () https://zigrin.com/advisories/imagicle-sql-injection-vulnerability-in-contacts-csv-export/ - | |
| CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 9.9 |
21 Oct 2021, 12:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Imagicle/CVE - Third Party Advisory | |
| References | (MISC) https://www.imagicle.com/en/resources/download/ - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 8.8 |
| CPE | cpe:2.3:a:zucchetti:imagicle_uc_suite:*:*:*:*:*:*:*:* | |
| CWE | CWE-89 |
14 Oct 2021, 18:58
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-10-14 18:15
Updated : 2024-11-21 06:27
NVD link : CVE-2021-42369
Mitre link : CVE-2021-42369
CVE.ORG link : CVE-2021-42369
JSON object : View
Products Affected
zucchetti
- imagicle_uc_suite
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')