CVE-2019-18229 - OpenCVE

Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage these vulnerabilities to disclose information.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Advantech	Wise-paas\/rmm

Configuration 1 [-]

cpe:2.3:a:advantech:wise-paas\/rmm:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.us-cert.gov/ics/advisories/icsa-19-304-01
https://www.zerodayinitiative.com/advisories/ZDI-19-937/
https://www.zerodayinitiative.com/advisories/ZDI-19-938/
https://www.zerodayinitiative.com/advisories/ZDI-19-940/
https://www.zerodayinitiative.com/advisories/ZDI-19-948/
https://www.zerodayinitiative.com/advisories/ZDI-19-949/
https://www.zerodayinitiative.com/advisories/ZDI-19-951/
https://www.zerodayinitiative.com/advisories/ZDI-19-952/
https://www.zerodayinitiative.com/advisories/ZDI-19-955/
https://www.zerodayinitiative.com/advisories/ZDI-19-956/
https://www.zerodayinitiative.com/advisories/ZDI-19-957/

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2019-10-31T21:05:02

Updated: 2024-08-05T01:47:13.988Z

Reserved: 2019-10-22T00:00:00

Link: CVE-2019-18229

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2019-10-31T22:15:11.020

Modified: 2021-05-13T19:26:32.110

Link: CVE-2019-18229

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Advantech WISE-PaaS/RMM", "vendor": "n/a", "versions": [{"status": "affected", "version": "Versions 3.3.29 and prior"}]}], "descriptions": [{"lang": "en", "value": "Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage these vulnerabilities to disclose information."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION') CWE-89", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-11-01T19:06:36", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.us-cert.gov/ics/advisories/icsa-19-304-01"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-949/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-940/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-938/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-951/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-955/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-937/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-956/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-952/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-957/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-948/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2019-18229", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Advantech WISE-PaaS/RMM", "version": {"version_data": [{"version_value": "Versions 3.3.29 and prior"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage these vulnerabilities to disclose information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION') CWE-89"}]}]}, "references": {"reference_data": [{"name": "https://www.us-cert.gov/ics/advisories/icsa-19-304-01", "refsource": "MISC", "url": "https://www.us-cert.gov/ics/advisories/icsa-19-304-01"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-949/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-949/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-940/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-940/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-938/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-938/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-951/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-951/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-955/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-955/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-937/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-937/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-956/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-956/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-952/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-952/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-957/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-957/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-948/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-948/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T01:47:13.988Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.us-cert.gov/ics/advisories/icsa-19-304-01"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-949/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-940/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-938/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-951/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-955/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-937/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-956/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-952/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-957/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-948/"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2019-18229", "datePublished": "2019-10-31T21:05:02", "dateReserved": "2019-10-22T00:00:00", "dateUpdated": "2024-08-05T01:47:13.988Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:advantech:wise-paas\\/rmm:*:*:*:*:*:*:*:*", "matchCriteriaId": "5EDCD905-0F30-4CB7-A70A-266213818B1A", "versionEndIncluding": "3.3.29", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage these vulnerabilities to disclose information."}, {"lang": "es", "value": "Advantech WISE-PaaS/RMM, versiones 3.3.29 y anteriores. Una falta de saneamiento de la entrada suministrada por el usuario causa vulnerabilidades de inyecci\u00f3n SQL. Un atacante puede aprovechar estas vulnerabilidades para divulgar informaci\u00f3n."}], "id": "CVE-2019-18229", "lastModified": "2021-05-13T19:26:32.110", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-10-31T22:15:11.020", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-19-304-01"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-937/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-938/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-940/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-948/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-949/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-951/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-952/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-955/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-956/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-957/"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}