CVE-2017-14396

Опубликовано: 12 сент. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php.

Ссылки

http://www.osticket.com/blog/125
Patch
Vendor Advisory
http://www.osticket.com/blog/125
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:osticket:osticket:1.10:*:*:*:*:*:*:*

EPSS

Процентиль: 86%

0.02918

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

CVE-2017-14396

CVSS3: 9.8

debian

около 9 лет назад

In osTicket before 1.10.1, SQL injection is possible by constructing a ...

GHSA-v33m-xv4g-2xv2

CVSS3: 9.8

github

больше 4 лет назад

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php.

EPSS

Процентиль: 86%

0.02918

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89