CVE-2021-35234CWE-89

Exposed Dangerous Functions - Privileged Escalation

High · published December 20, 2021

CVSS v3.1
8.0
EPSS
3%
Percentile
86.8
In the wild
Unconfirmed
What it is

Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02888 · 86.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2021-12-20T20:08Z
EPSS history
Timeline
  • 20 DEC 20:08Z
    Exposed Dangerous Functions - Privileged Escalation
    cvelistv5