PT-2024-39966 · Webeip · Webeip

Published 2024-10-14 · Updated 2024-10-19 · CVE-2024-9968

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebEIP version 3.0

Description The issue concerns a lack of proper validation of user input, allowing remote attackers with regular privilege to inject SQL commands and potentially read, modify, or delete data stored in the database. The affected product is no longer maintained.

Recommendations As a temporary workaround, consider restricting access to the database until a patch is available. Upgrade to a supported version for enhanced security. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-9968

Affected Products

Webeip

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-9968 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9968 · Vendor Advisory
• https://t.me/latest_high_impact_cve/1326 · Telegram Post
• https://twitter.com/cracbot/status/1847518142890946809 · Twitter Post
• https://t.me/cvenotify/98834 · Telegram Post
• https://t.me/cvedetector/7878 · Telegram Post
• https://twcert.org.tw/tw/cp-132-8132-160bb-1.html · Note
• https://twitter.com/VulmonFeeds/status/1846070945003290693 · Twitter Post
• https://twitter.com/CveFindCom/status/1846023545765130555 · Twitter Post
• https://twcert.org.tw/en/cp-139-8133-2cc3a-2.html · Note
• https://t.me/cvenotify/98022 · Telegram Post