PT-2018-5455 · Moxa · Moxa Softcms Live Viewer

Publicado 2018-01-18 · Atualizado 2019-10-09 · CVE-2017-12729

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Moxa SoftCMS Live Viewer versions 1.6 and earlier

Description: A SQL Injection issue has been discovered, allowing attackers to exploit an improper neutralization of special elements used in an SQL command. This enables access to SoftCMS without knowing the user's password.

Recommendations: For Moxa SoftCMS Live Viewer versions 1.6 and earlier, consider restricting access to the SQL database to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using user input in SQL commands to prevent injection attacks.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-12729

Produtos afetados

Moxa Softcms Live Viewer

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-12729 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-17-243-05 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-12729 · Nota de Segurança