CVE-2024-29732
Assigner: INCIBE
Published: 2024-03-21T10:37:08.440Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: SCAN_VISIO eDocument Suite Web Viewer
vendor: Abast
versions: status: affected
version: 3.28.1
credits: type: reporter
value: Alberto Gasulla
type: other
value: Ismael Pacheco Torrecilla
datePublic: 2024-03-21T10:32:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: A SQL Injection has been found on SCAN_VISIO eDocument Suite Web Viewer of Abast. This vulnerability allows an unauthenticated user to retrieve, update and delete all the information of database. This vulnerability was found on login page via "user" parameter.
value: A SQL Injection has been found on SCAN_VISIO eDocument Suite Web Viewer of Abast. This vulnerability allows an unauthenticated user to retrieve, update and delete all the information of database. This vulnerability was found on login page via "user" parameter.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Vulnerability has been fixed in later versions.
value: Vulnerability has been fixed in later versions.
source: discovery: EXTERNAL
title: SQL Injection vulnerability on SCAN_VISIO eDocument Suite Web Viewer from Abast
x_generator: engine: Vulnogram 0.1.0-dev