CVE-2016-2346

Опубликовано: 25 апр. 2016

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

Allround Automations PL/SQL Developer 11 before 11.0.6 relies on unverified HTTP data for updates, which allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream.

Ссылки

http://www.kb.cert.org/vuls/id/229047
Third Party Advisory
US Government Resource
https://adamcaudill.com/2016/02/02/plsql-developer-nonexistent-encryption/
Exploit
http://www.kb.cert.org/vuls/id/229047
Third Party Advisory
US Government Resource
https://adamcaudill.com/2016/02/02/plsql-developer-nonexistent-encryption/
Exploit

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:allroundautomations:pl\/sql_developer:11.0:*:*:*:*:*:*:*

cpe:2.3:a:allroundautomations:pl\/sql_developer:11.0.1:*:*:*:*:*:*:*

cpe:2.3:a:allroundautomations:pl\/sql_developer:11.0.2:*:*:*:*:*:*:*

cpe:2.3:a:allroundautomations:pl\/sql_developer:11.0.3:*:*:*:*:*:*:*

cpe:2.3:a:allroundautomations:pl\/sql_developer:11.0.4:*:*:*:*:*:*:*

cpe:2.3:a:allroundautomations:pl\/sql_developer:11.0.5:*:*:*:*:*:*:*

EPSS

Процентиль: 45%

0.00222

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-345

Связанные уязвимости

GHSA-p6r4-24w5-r764