CVE-2024-8308 | THREATINT

Description

A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltrate all data.

Reserved 2024-08-29 | Published 2024-11-28 | Updated 2024-11-29 | Assigner CERTVDE

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status

unaffected

Any version before 7.4.3

affected

Credits

Johannes Lauinger of SySS GmbH finder

Fidelis Abt of SySS GmbH finder

References

www.syss.de/...sql-injection-in-siempelkamp-nis-umweltoffice third-party-advisory

cve.org (CVE-2024-8308)

nvd.nist.gov (CVE-2024-8308)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.