CVE-2017-11508CWE-89sql-injection

CVE-2017-11508

High · published November 2, 2017

CVSS v3.0
8.8
EPSS
1%
Percentile
68.1
In the wild
Unconfirmed
What it is

SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a diagnostic scan within SecurityCenter. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01212 · 68.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2017-11-02T21:29Z
Affected products (3)
ProductVersionsFixed in
tenable/security_centerall versions—
tenable/security_centerall versions—
tenable/security_centerall versions—
References (4)
http://www.securitytracker.com/id/1039804 · [email protected]https://www.tenable.com/security/tns-2017-13 · [email protected]http://www.securitytracker.com/id/1039804 · af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/tns-2017-13 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 02 NOV 17:00Z
    SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient…
    cvelistv5