PT-2021-22989 · Genesys · Genesys Iwd

Gabor Szivos · Published 2021-12-08 · Updated 2021-12-13 · CVE-2021-40860

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Genesys intelligent Workload Distribution (IWD) versions prior to 9.0.013.11

Description A SQL Injection issue in the custom filter query component allows an attacker to execute arbitrary SQL queries via the ql expression parameter. This enables the extraction of all data in the database and potentially allows OS command execution, depending on the permissions and/or database engine.

Recommendations For versions prior to 9.0.013.11, update to version 9.0.013.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the custom filter query component to minimize the risk of exploitation. Avoid using the ql expression parameter in the affected component until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-40860

Affected Products

Genesys Iwd

References · 5

• 🔥 https://offensity.com/en/blog/authenticated-sql-injection-in-the-genesys-iwd-manager-cve-2021-40860-and-cve-2021-40861 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-40860 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40860 · Vendor Advisory
• https://docs.genesys.com/Documentation/IWD · Vendor Advisory
• https://t.me/cibsecurity/33605 · Telegram Post