CVE-2019-5070CWE-89

An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier

Medium · published September 5, 2019

CVSS v3.0
6.5
EPSS
1%
Percentile
63.0
In the wild
Unconfirmed
What it is

An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier. Specially crafted web request to login page can cause SQL injections, resulting in data compromise. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01025 · 63.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2019-09-05T16:52Z
EPSS history
Timeline
  • 05 SEP 16:52Z
    An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier
    cvelistv5