PT-2023-10153 · Anant · Google-Enterprise-Connector-Dctm

Published 2023-01-19 · Updated 2024-05-17 · CVE-2014-125083

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Anant Labs google-enterprise-connector-dctm versions up to 3.2.3

Description A critical vulnerability has been found in the software, affecting an unknown functionality. The manipulation of the username and domain arguments leads to SQL injection.

Recommendations For versions up to 3.2.3, it is recommended to apply a patch to fix this issue. The patch is named 6fba04f18ab7764002a1da308e7cd9712b501cb7. As a temporary workaround, consider restricting the manipulation of the username and domain arguments to minimize the risk of SQL injection.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-125083

Affected Products

Google-Enterprise-Connector-Dctm

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2014-125083 · Security Note
• https://github.com/AnantLabs/google-enterprise-connector-dctm/commit/6fba04f18ab7764002a1da308e7cd9712b501cb7 · Patch
• https://t.me/cibsecurity/56707 · Telegram Post
• https://vuldb.com/?ctiid.218911 · Note
• https://vuldb.com/?id.218911 · Note
• https://t.me/cvenotify/42410 · Telegram Post
• https://t.me/cvenotify/42846 · Telegram Post