nvd-json-data-feeds/CVE-2018/CVE-2018-110xx/CVE-2018-11065.json

{
  "id": "CVE-2018-11065",
  "sourceIdentifier": "security_alert@emc.com",
  "published": "2018-08-24T15:29:00.497",
  "lastModified": "2019-10-09T23:33:21.167",
  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
      "value": "The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x prior to 6.4.0.1, contains a SQL injection vulnerability. A malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to read certain data. Embedded WorkPoint is upgraded to version 4.10.16, which contains a fix for the vulnerability."
    },
    {
      "lang": "es",
      "value": "El componente WorkPoint que est\u00e1 embebido en RSA Archer, en versiones 6.1.x, 6.2.x, 6.3.x anteriores a la 6.3.0.7 y 6.4.x anteriores a la 6.4.0.1, contiene una vulnerabilidad de inyecci\u00f3n SQL. Un usuario malicioso podr\u00eda explotar esta vulnerabilidad para ejecutar comandos SQL en la base de datos del backend para leer ciertos datos. El WorkPoint embebido se ha actualizado a la versi\u00f3n 4.10.16, que contiene una soluci\u00f3n para la vulnerabilidad."
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      },
      {
        "source": "security_alert@emc.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "baseSeverity": "LOW"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 1.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.1.0.0",
              "versionEndExcluding": "6.1.0.3",
              "matchCriteriaId": "C92052E9-4E4A-4E90-8F32-CF15B9143C54"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.2.0.0",
              "versionEndExcluding": "6.2.0.10",
              "matchCriteriaId": "E833FC3F-F1A5-456F-BE9C-B6D72C37A236"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.3.0.0",
              "versionEndExcluding": "6.3.0.7",
              "matchCriteriaId": "99D4D067-E6C3-4CC8-BCA2-74DB301A4FDC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.4.0.0",
              "versionEndExcluding": "6.4.0.1",
              "matchCriteriaId": "8955D404-92B2-4EBF-83D1-333457B8E86B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://seclists.org/fulldisclosure/2018/Aug/31",
      "source": "security_alert@emc.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/105128",
      "source": "security_alert@emc.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "http://www.securitytracker.com/id/1041540",
      "source": "security_alert@emc.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    }
  ]
}