PT-2023-10331 · Salesforce · Salesforcemobilesdk-Windows

CVE-2016-15012 · Publicado 2023-01-07 · Atualizado 2024-08-06

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SalesforceMobileSDK-Windows versions up to 4.x

Description A critical issue affects the function ComputeCountSql of the file SalesforceSDK/SmartStore/Store/QuerySpec.cs, leading to sql injection. This issue only affects products that are no longer supported by the maintainer.

Recommendations For versions up to 4.x, upgrade to version 5.0.0 to address this issue. As a temporary workaround, consider restricting the use of the ComputeCountSql function until the upgrade is applied.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2016-15012

Produtos afetados

Salesforcemobilesdk-Windows

Referências · 9

• https://github.com/forcedotcom/SalesforceMobileSDK-Windows/releases/tag/v5.0.0 · Correção
• https://github.com/forcedotcom/SalesforceMobileSDK-Windows/commit/83b3e91e0c1e84873a6d3ca3c5887eb5b4f5a3d8 · Correção
• https://t.me/cvenotify/41487 · Publicação no Telegram
• https://vuldb.com/?ctiid.217619 · Nota
• https://osv.dev/vulnerability/CVE-2016-15012 · Aviso do Fabricante
• https://vuldb.com/?id.217619 · Nota
• https://t.me/cvenotify/89342 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-15012 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-15012 · Nota de Segurança