CVE-2023-35851

{"id": "CVE-2023-35851", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-09-18T03:15:08.017", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7372-3994a-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "\nSUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.\n\n"}, {"lang": "es", "value": "La funci\u00f3n de preguntas frecuentes del portal SUNNET WMPro no tiene una validaci\u00f3n suficiente para la entrada del usuario. Un atacante remoto no autenticado puede inyectar comandos SQL arbitrarios para obtener informaci\u00f3n sensible a trav\u00e9s de una base de datos. "}], "lastModified": "2023-09-20T20:47:12.903", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sun.net:wmpro:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6868DAD-1076-4242-95D1-92E0B11B6F92"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}