CVE-2021-42131CWE-89

A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation

published December 7, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.3th percentile for exploit probability.

CVSS

—

EPSS

67%

Percentile

99.3

In the wild

Unconfirmed

What it is

A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.66527 · 99.3th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2021-12-07T13:13Z

EPSS history

Timeline

07 DEC 13:13Z
A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation
cvelistv5