PT-2023-18277 · Blackberry · Blackberry Athoc

Published 2023-09-12 · Updated 2023-09-15 · CVE-2023-21521

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlackBerry AtHoc version 7.15

Description An SQL Injection issue in the Management Console (Operator Audit Trail) could allow an attacker to read sensitive data from the database, modify database data, execute administration operations on the database, recover the content of a given file present on the DBMS file system, and in some cases issue commands to the operating system.

Recommendations For version 7.15, consider disabling access to the Management Console (Operator Audit Trail) until a patch is available to prevent potential SQL Injection attacks. Restrict database privileges to minimize the risk of data modification or unauthorized access. Avoid using sensitive data in the Management Console to reduce the potential impact of an SQL Injection attack.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-21521

Affected Products

Blackberry Athoc

References · 5

• https://support.blackberry.com/kb/articleDetail?articleNumber=000112406 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-21521 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21521 · Security Note
• https://twitter.com/CVEnew/status/1701666658392367500 · Twitter Post
• https://t.me/cibsecurity/70338 · Telegram Post