CVE-2021-36722

HIGH

7.1

Beschreibung

Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host.

CVE Details

CVSS v3.1 Bewertung7.1

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionREQUIRED

Veroffentlicht12/29/2021

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

emuse_-_eservices_\/_envoice_project:emuse_-_eservices_\/_envoice

Schwachen (CWE)

CWE-89CWE-89

Referenzen

https://www.gov.il/en/departments/faq/cve_advisories(cna@cyber.gov.il)

https://www.gov.il/en/departments/faq/cve_advisories(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.