CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 6.5
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: securitycenter versions 5.5.0, 5.5.1 and 5.5.2 contain a sql injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. an attacker could exploit this vulnerability by entering a crafted sql query into the password field of a diagnostic scan within securitycenter. successful exploitation of this vulnerability could allow an attacker to gain unauthorized access.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2017-11-02
Last Modified Date: 2017-11-22