CVE-2018-1252

 

Published at: - 05-06-2018 02:29

Last modified: - 26-09-2022 06:45

Total changes: - 2

Description

RSA Web Threat Detection versions prior to 6.4, contain an SQL injection vulnerability in the Administration and Forensics applications. An authenticated malicious user with low privileges could potentially exploit this vulnerability to execute SQL commands on the back-end database to gain unauthorized access to the tool's monitoring and user information by supplying specially crafted input data to the affected application.

Common Vulnerability Scoring System (CVSS)

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• 20180531 DSA-2018-085: RSA Web Threat Detection SQL Injection Vulnerability-Mailing List, Third Party Advisory
• 1041026-Third Party Advisory, VDB Entry
• 104396-Third Party Advisory, VDB Entry

 

Keywords

NVD

 

CVE-2018-1252

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures