PT-2022-8325 · Unknown · S::Can Moni::Tools

Kürşat Çetin · Published 2022-11-07 · Updated 2022-11-17 · CVE-2020-12507

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions s::can moni::tools versions prior to 4.2

Description The issue allows an authenticated attacker to gain full access to the database through SQL injection, potentially resulting in loss of confidentiality, loss of integrity, and Denial of Service (DoS).

Recommendations For versions prior to 4.2, update to version 4.2 or later to resolve the issue. As a temporary workaround, consider restricting database access to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-12507

Affected Products

S::Can Moni::Tools

References · 4

• https://s-can.at/en/the-new-monitool-v4-2-security-first · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12507 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12507 · Security Note
• https://t.me/cibsecurity/53001 · Telegram Post