PT-2023-12439 · Itrs · Monitor-Ninja

Published 2023-05-28 · Updated 2024-05-17 · CVE-2021-4336

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ITRS Group monitor-ninja versions up to 2021.11.1

Description A critical issue affects some unknown functionality of the file modules/reports/models/scheduled reports.php, leading to sql injection. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For ITRS Group monitor-ninja versions up to 2021.11.1, upgrade to version 2021.11.30 to address this issue. As a temporary workaround, consider restricting access to the file modules/reports/models/scheduled reports.php until the upgrade is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-4336

Affected Products

Monitor-Ninja

References · 7

• https://github.com/ITRS-Group/monitor-ninja/releases/tag/v2021.11.30 · Patch
• https://github.com/ITRS-Group/monitor-ninja/commit/6da9080faec9bca1ca5342386c0421dca0a6c0cc · Patch
• https://osv.dev/vulnerability/CVE-2021-4336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4336 · Security Note
• https://vuldb.com/?id.230084 · Note
• https://t.me/cvenotify/51308 · Telegram Post
• https://vuldb.com/?ctiid.230084 · Note