2 lines
3.2 KiB
JSON
2 lines
3.2 KiB
JSON
{"affected":[{"affectedData":[{"product":"Advantech","vendor":"n/a","versions":[{"status":"affected","version":"Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021)"}]}],"source":"talos-cna@cisco.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:advantech:r-seenet:2.4.15:*:*:*:*:*:*:*","matchCriteriaId":"B47E708F-D51A-41B3-8708-90C003C2D2DC","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ord’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery attack."},{"lang":"es","value":"Una petición HTTP especialmente diseñada puede conllevar a una inyección SQL. Un atacante puede realizar peticiones HTTP autenticadas para desencadenar esta vulnerabilidad en el parámetro \"ord\". Sin embargo, es necesario usar la cuenta de superadministrador de alto privilegio para lograr una explotación sin un ataque de tipo cross-site request forgery"}],"id":"CVE-2021-21919","lastModified":"2026-06-17T03:36:21.670","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":4.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":8.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"talos-cna@cisco.com","type":"Secondary"}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2021-12-22T19:15:10.283","references":[{"source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"],"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2021-1364"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2021-1364"}],"sourceIdentifier":"talos-cna@cisco.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"talos-cna@cisco.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-89"}],"source":"nvd@nist.gov","type":"Primary"}]}
|