PT-2019-14286 · Bedita · Bedita

Fquffio · Publicado 2019-08-26 · Atualizado 2022-05-24 · CVE-2019-15570

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BEdita versions prior to 4.0.0-RC2

Description The issue allows SQL injection during a save operation for a relation with parameters due to a lack of JSON escaping.

Recommendations For versions prior to 4.0.0-RC2, update to a version that includes proper JSON escaping to prevent SQL injection attacks.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-15570

GHSA-9GV2-2M38-J6CX

Produtos afetados

Bedita

Referências · 6

• https://github.com/bedita/bedita/pull/1608 · Correção
• https://github.com/bedita/bedita/commit/0ddcd46d645c773e69369f3ed82c865a4d098454 · Nota
• https://github.com/bedita/bedita · Nota
• https://osv.dev/vulnerability/CVE-2019-15570 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15570 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-9gv2-2m38-j6cx · Aviso do Fabricante