PT-2019-3539 · Zingbox · Zingbox Inspector

Published 2019-10-01 · Updated 2023-02-04 · CVE-2019-15016

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zingbox Inspector versions 1.288 and earlier

Description The issue is related to an SQL injection vulnerability in the management interface, allowing unsanitized data from an authenticated user to be passed into the database. This vulnerability is associated with a lack of protection for the SQL query structure, which could allow a remote attacker to disclose protected information.

Recommendations For Zingbox Inspector versions 1.288 and earlier, consider restricting access to the management interface until a fix is available. As a temporary workaround, limit the input data that can be passed from the web UI into the database to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2019-03716

CVE-2019-15016

Affected Products

Zingbox Inspector

References · 5

• https://bdu.fstec.ru/vul/2019-03716 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15016 · Security Note
• https://security.paloaltonetworks.com/CVE-2019-15016 · Note
• https://securityadvisories.paloaltonetworks.com/Home/Detail/173 · Note