CVE-2021-36385

Опубликовано: 24 авг. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fullwidth Apostrophe (aka U+FF07) in the default.aspx User ID field. Arbitrary system commands can be executed through the use of xp_cmdshell.

Ссылки

https://www.blacklanternsecurity.com/2021-08-13-Cerner-MobileCare-CVE/
Third Party Advisory
https://www.blacklanternsecurity.com/blog/
Third Party Advisory
https://www.cerner.com/solutions/mobility
Product
Vendor Advisory
https://www.blacklanternsecurity.com/2021-08-13-Cerner-MobileCare-CVE/
Third Party Advisory
https://www.blacklanternsecurity.com/blog/
Third Party Advisory
https://www.cerner.com/solutions/mobility
Product
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:cerner:mobile_care:5.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 87%

0.03461

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-w2fh-v26x-wx46

github

больше 3 лет назад