PT-2024-37869 · Connex · Connex
Published
2024-09-09
·
Updated
2024-11-23
·
CVE-2024-6795
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Connex health portal versions prior to 8/30/2024
Description
The issue concerns SQL injection vulnerabilities that could allow an unauthenticated attacker to gain unauthorized access to the Connex portal's database. An attacker could submit a crafted payload to the portal, resulting in modification and disclosure of database content, and/or perform administrative operations, including shutting down the database.
Recommendations
For versions prior to 8/30/2024, update to a version released after 8/30/2024 to resolve the issue. As a temporary workaround, consider restricting access to the database and implementing additional security measures to minimize the risk of exploitation.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Connex