PT-2023-10153 · Anant · Google-Enterprise-Connector-Dctm

CVE-2014-125083 · Publicado 2023-01-19 · Atualizado 2024-05-17

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Média

Vetor base

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Anant Labs google-enterprise-connector-dctm versions up to 3.2.3

Description A critical vulnerability has been found in the software, affecting an unknown functionality. The manipulation of the username and domain arguments leads to SQL injection.

Recommendations For versions up to 3.2.3, it is recommended to apply a patch to fix this issue. The patch is named 6fba04f18ab7764002a1da308e7cd9712b501cb7. As a temporary workaround, consider restricting the manipulation of the username and domain arguments to minimize the risk of SQL injection.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-125083

Produtos afetados

Google-Enterprise-Connector-Dctm

Referências · 7

• https://t.me/cibsecurity/56707 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2014-125083 · Nota de Segurança
• https://vuldb.com/?ctiid.218911 · Nota
• https://vuldb.com/?id.218911 · Nota
• https://t.me/cvenotify/42410 · Publicação no Telegram
• https://github.com/AnantLabs/google-enterprise-connector-dctm/commit/6fba04f18ab7764002a1da308e7cd9712b501cb7 · Correção
• https://t.me/cvenotify/42846 · Publicação no Telegram