nvd-json-data-feeds/CVE-2023/CVE-2023-44xx/CVE-2023-4485.json

{
  "id": "CVE-2023-4485",
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "published": "2023-09-06T00:15:07.530",
  "lastModified": "2024-11-21T08:35:15.847",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ARDEREG\u00a0\u200bSistema SCADA Central versions 2.203 and prior\nlogin page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, the vulnerability could allow an attacker to execute arbitrary SQL queries through the login page, potentially leading to unauthorized access, data leakage, or even disruption of critical industrial processes.\n\n"
    },
    {
      "lang": "es",
      "value": "ARDEREG ?Sistema SCADA Central versiones 2.203 y anteriores, la p\u00e1gina de inicio de sesi\u00f3n son vulnerables a un ataque de inyecci\u00f3n blind SQL no autenticada. Un atacante podr\u00eda manipular la l\u00f3gica de consulta SQL de la aplicaci\u00f3n para extraer informaci\u00f3n confidencial o realizar acciones no autorizadas dentro de la base de datos. En este caso, la vulnerabilidad podr\u00eda permitir a un atacante ejecutar consultas SQL arbitrarias a trav\u00e9s de la p\u00e1gina de inicio de sesi\u00f3n, lo que podr\u00eda provocar acceso no autorizado, fuga de datos o incluso interrupci\u00f3n de procesos industriales cr\u00edticos.\n"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "ics-cert@hq.dhs.gov",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      },
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ardereg:sistemas_scada:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "2.203",
              "matchCriteriaId": "C51DD5B5-A3FA-482B-819F-100F193CEB96"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-01",
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ]
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-01",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ]
    }
  ]
}