2 lines
3.1 KiB
JSON
2 lines
3.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MegaBIP","vendor":"Jan Syski","versions":[{"lessThanOrEqual":"5.19","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provided by the the user is not sanitized, leading to SQL Injection vulnerability. \nVersion 5.20 of MegaBIP fixes this issue."},{"lang":"es","value":"Al editar páginas administradas por MegaBIP, se solicita a un usuario con privilegios elevados que justifique la acción. La información proporcionada por el usuario no se depura, lo que genera una vulnerabilidad de inyección SQL. La versión 5.20 de MegaBIP corrige este problema."}],"id":"CVE-2025-3893","lastModified":"2026-06-17T09:20:52.663","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-3893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-05-23T12:12:44.134029Z","version":"2.0.3"}}]},"published":"2025-05-23T11:15:32.660","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/en/posts/2025/05/CVE-2025-3893"},{"source":"cvd@cert.pl","url":"https://megabip.pl/index.php?id=24,145"},{"source":"cvd@cert.pl","url":"https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"cvd@cert.pl","type":"Secondary"}]}
|