CVE-2020-12507 - OpenCVE

In s::can moni::tools before version 4.2 an authenticated attacker could get full access to the database through SQL injection. This may result in loss of confidentiality, loss of integrity and DoS.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Badgermeter	Moni\

Configuration 1 [-]

cpe:2.3:a:badgermeter:moni\:\:tool:4.2:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.s-can.at/en/the-new-monitool-v4-2-security-first/

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2022-11-07T09:39:53.104Z

Updated: 2024-08-04T11:56:52.087Z

Reserved: 2020-04-30T00:00:00.000Z

Link: CVE-2020-12507

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-11-15T21:15:20.507

Modified: 2022-11-17T05:21:31.847

Link: CVE-2020-12507

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2020-12507", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "requesterUserId": "b10c23db-d69c-4177-8d87-267a354894ff", "dateReserved": "2020-04-30T00:00:00.000Z", "datePublished": "2022-11-07T09:39:53.104Z", "dateUpdated": "2024-08-04T11:56:52.087Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "moni:tools", "vendor": "s::can", "versions": [{"lessThan": "4.2", "status": "affected", "version": "1.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "K\u00fcr\u015fat \u00c7etin"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In s::can moni::tools before version 4.2 an authenticated attacker could get full access to the database through SQL injection. This may result in loss of confidentiality, loss of integrity and DoS."}], "value": "In s::can moni::tools before version 4.2 an authenticated attacker could get full access to the database through SQL injection. This may result in loss of confidentiality, loss of integrity and DoS."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2022-11-15T20:43:00.000Z"}, "references": [{"url": "https://www.s-can.at/en/the-new-monitool-v4-2-security-first/"}], "source": {"defect": ["VDE#2020091110000013"], "discovery": "EXTERNAL"}, "title": "s::can moni::tools autheticated SQL injection ", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:56:52.087Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.s-can.at/en/the-new-monitool-v4-2-security-first/", "tags": ["x_transferred"]}]}]}}