167 lines
6.7 KiB
JSON
167 lines
6.7 KiB
JSON
{
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"product": "OpenClinic GA",
|
||
"vendor": "n/a",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "OpenClinic GA 5.173.3"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findDistrict parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_0": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "NONE",
|
||
"baseScore": 6.4,
|
||
"baseSeverity": "MEDIUM",
|
||
"confidentialityImpact": "LOW",
|
||
"integrityImpact": "LOW",
|
||
"privilegesRequired": "LOW",
|
||
"scope": "CHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
||
"version": "3.0"
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-89",
|
||
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"dateUpdated": "2021-05-10T18:36:30.000Z",
|
||
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
|
||
"shortName": "talos"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1205"
|
||
}
|
||
],
|
||
"x_legacyV4Record": {
|
||
"CVE_data_meta": {
|
||
"ASSIGNER": "talos-cna@cisco.com",
|
||
"ID": "CVE-2020-27231",
|
||
"STATE": "PUBLIC"
|
||
},
|
||
"affects": {
|
||
"vendor": {
|
||
"vendor_data": [
|
||
{
|
||
"product": {
|
||
"product_data": [
|
||
{
|
||
"product_name": "OpenClinic GA",
|
||
"version": {
|
||
"version_data": [
|
||
{
|
||
"version_value": "OpenClinic GA 5.173.3"
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
},
|
||
"vendor_name": "n/a"
|
||
}
|
||
]
|
||
}
|
||
},
|
||
"data_format": "MITRE",
|
||
"data_type": "CVE",
|
||
"data_version": "4.0",
|
||
"description": {
|
||
"description_data": [
|
||
{
|
||
"lang": "eng",
|
||
"value": "A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findDistrict parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability."
|
||
}
|
||
]
|
||
},
|
||
"impact": {
|
||
"cvss": {
|
||
"baseScore": 6.4,
|
||
"baseSeverity": "Medium",
|
||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
||
"version": "3.0"
|
||
}
|
||
},
|
||
"problemtype": {
|
||
"problemtype_data": [
|
||
{
|
||
"description": [
|
||
{
|
||
"lang": "eng",
|
||
"value": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"references": {
|
||
"reference_data": [
|
||
{
|
||
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1205",
|
||
"refsource": "MISC",
|
||
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1205"
|
||
}
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-04T16:11:36.113Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"x_refsource_MISC",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1205"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"cveMetadata": {
|
||
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
|
||
"assignerShortName": "talos",
|
||
"cveId": "CVE-2020-27231",
|
||
"datePublished": "2021-05-10T18:36:30.000Z",
|
||
"dateReserved": "2020-10-19T00:00:00.000Z",
|
||
"dateUpdated": "2024-08-04T16:11:36.113Z",
|
||
"state": "PUBLISHED"
|
||
},
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1"
|
||
} |