CVE-2019-7484 - OpenCVE

Authenticated SQL Injection in SonicWall SMA100 allow user to gain read-only access to unauthorized resources using viewcacert CGI script. This vulnerability impacted SMA100 version 9.0.0.3 and earlier.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Sonicwall	Sma 100 Sma 100 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:sonicwall:sma_100_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sonicwall:sma_100:-:*:*:*:*:*:*:*

References

Link	Resource
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0019	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: sonicwall

Published: 2019-12-19T00:35:44

Updated: 2019-12-19T00:35:44

Reserved: 2019-02-06T00:00:00

Link: CVE-2019-7484

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-12-19T01:15:10.883

Modified: 2019-12-31T20:36:24.430

Link: CVE-2019-7484

JSON object: View

Redhat Information

No data.

CWE

CWE-89

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sonicwall:sma_100_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5EF6331-01A9-4DAD-8896-D90470116EA5", "versionEndIncluding": "9.0.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sonicwall:sma_100:-:*:*:*:*:*:*:*", "matchCriteriaId": "7B164EB6-4CA0-46EF-986D-270968E87C5C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Authenticated SQL Injection in SonicWall SMA100 allow user to gain read-only access to unauthorized resources using viewcacert CGI script. This vulnerability impacted SMA100 version 9.0.0.3 and earlier."}, {"lang": "es", "value": "Una inyecci\u00f3n SQL autenticada en SonicWall SMA100, permite al usuario conseguir acceso de solo lectura a recursos no autorizados utilizando el script viewcacert CGI. Esta vulnerabilidad impact\u00f3 a SMA100 versi\u00f3n 9.0.0.3 y anteriores."}], "id": "CVE-2019-7484", "lastModified": "2019-12-31T20:36:24.430", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-19T01:15:10.883", "references": [{"source": "PSIRT@sonicwall.com", "tags": ["Vendor Advisory"], "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0019"}], "sourceIdentifier": "PSIRT@sonicwall.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "PSIRT@sonicwall.com", "type": "Secondary"}]}