CVE-2021-4246

A vulnerability was found in roxlukas LMeve and classified as critical. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument X-Forwarded-For leads to sql injection. The attack may be launched remotely. The name of the patch is 29e1ead3bb1c1fad53b77dfc14534496421c5b5d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216176.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/roxlukas/lmeve/commit/29e1ead3bb1c1fad53b77dfc14534496421c5b5d	Patch Third Party Advisory
https://vuldb.com/?id.216176	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lmeve_project:lmeve:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-12-17 19:15

Updated : 2023-11-07 03:40

NVD link : CVE-2021-4246

Mitre link : CVE-2021-4246

CVE.ORG link : CVE-2021-4246

JSON object : View

Products Affected

lmeve_project

lmeve

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-707

Improper Neutralization

{"id": "CVE-2021-4246", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2022-12-17T19:15:08.887", "references": [{"url": "https://github.com/roxlukas/lmeve/commit/29e1ead3bb1c1fad53b77dfc14534496421c5b5d", "tags": ["Patch", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.216176", "tags": ["Third Party Advisory"], "source": "cna@vuldb.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-707"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in roxlukas LMeve and classified as critical. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument X-Forwarded-For leads to sql injection. The attack may be launched remotely. The name of the patch is 29e1ead3bb1c1fad53b77dfc14534496421c5b5d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216176."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en roxlukas LMeve y clasificada como cr\u00edtica. Una funci\u00f3n desconocida del componente Login Page es afectada por este problema. La manipulaci\u00f3n del argumento X-Forwarded-For conduce a una inyecci\u00f3n SQL. El ataque puede lanzarse de forma remota. El nombre del parche es 29e1ead3bb1c1fad53b77dfc14534496421c5b5d. Se recomienda aplicar un parche para solucionar este problema. El identificador de esta vulnerabilidad es VDB-216176."}], "lastModified": "2023-11-07T03:40:25.843", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lmeve_project:lmeve:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4CF8AFC-71B9-4705-83A4-1D8AB8AF03D4", "versionEndExcluding": "2021-02-13"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}