CVE-2024-3704
Assigner: INCIBE
Published: 2024-04-12T13:47:03.946Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: OpenGnsys
vendor: OpenGnsys
versions: status: affected
version: 1.1.1d
credits: type: finder
value: Pedro Gabaldón Julá
type: finder
value: Javier Medina Munuera
type: finder
value: Antonio José Gálvez Sánchez
datePublic: 2024-04-12T10:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to inject malicious SQL code into login page to bypass it or even retrieve all the information stored in the database.
value: SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to inject malicious SQL code into login page to bypass it or even retrieve all the information stored in the database.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
type: CWE
source: discovery: UNKNOWN
title: SQL Injection vulnerability in OpenGnsys
x_generator: engine: Vulnogram 0.1.0-dev