CVE-2017-20150

A vulnerability was found in challenge website. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The name of the patch is f1644b1d3502e5aa5284f31ea80d2623817f4d42. It is recommended to apply a patch to fix this issue. The identifier VDB-216989 was assigned to this vulnerability.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Challenge/website/commit/f1644b1d3502e5aa5284f31ea80d2623817f4d42	Patch Third Party Advisory
https://vuldb.com/?ctiid.216989	Permissions Required Third Party Advisory
https://vuldb.com/?id.216989	Permissions Required Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:challenge_website_project:challenge_website:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-12-28 19:15

Updated : 2024-05-17 01:17

NVD link : CVE-2017-20150

Mitre link : CVE-2017-20150

CVE.ORG link : CVE-2017-20150

JSON object : View

Products Affected

challenge_website_project

challenge_website

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2017-20150", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.1}]}, "published": "2022-12-28T19:15:08.837", "references": [{"url": "https://github.com/Challenge/website/commit/f1644b1d3502e5aa5284f31ea80d2623817f4d42", "tags": ["Patch", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.216989", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.216989", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cna@vuldb.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in challenge website. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The name of the patch is f1644b1d3502e5aa5284f31ea80d2623817f4d42. It is recommended to apply a patch to fix this issue. The identifier VDB-216989 was assigned to this vulnerability."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el sitio web Challenge. Ha sido calificado como cr\u00edtico. Este problema afecta alg\u00fan procesamiento desconocido. La manipulaci\u00f3n conduce a la inyecci\u00f3n de SQL. El nombre del parche es f1644b1d3502e5aa5284f31ea80d2623817f4d42. Se recomienda aplicar un parche para solucionar este problema. A esta vulnerabilidad se le asign\u00f3 el identificador VDB-216989."}], "lastModified": "2024-05-17T01:17:22.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:challenge_website_project:challenge_website:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EB8742B-DB30-4331-BF7F-25FF8602A129", "versionEndExcluding": "2017-01-24"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}