CVE-2024-6919 - Vulnerability Details

Vendors	Products
Nac	Nacpremium
Nac Telecommunication Systems	Nacpremium

Link	Providers
https://www.usom.gov.tr/bildirim/tr-24-1376

Type	Values Removed	Values Added
First Time appeared		Nac Nac nacpremium
CPEs		cpe:2.3:a:nac:nacpremium::::::::
Vendors & Products		Nac Nac nacpremium
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Type	Values Removed	Values Added
First Time appeared		Nac Telecommunication Systems Nac Telecommunication Systems nacpremium
CPEs		cpe:2.3:a:nac_telecommunication_systems:nacpremium::::::::
Vendors & Products		Nac Telecommunication Systems Nac Telecommunication Systems nacpremium
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.This issue affects NACPremium: through 01082024.
Title		SQLi in NAC Telecommunication's NACPremium
Weaknesses		CWE-89
References		https://www.usom.gov.tr/bildirim/tr-24-1376
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-6919", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2024-07-19T14:25:13.339Z", "datePublished": "2024-09-02T12:25:47.833Z", "dateUpdated": "2024-09-03T15:42:01.444Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "NACPremium", "vendor": "NAC Telecommunication Systems Inc.", "versions": [{"lessThanOrEqual": "01082024", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "P\u0131nar TA\u015e\u011eIN"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.<p>This issue affects NACPremium: through 01082024.</p>"}], "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.This issue affects NACPremium: through 01082024."}], "impacts": [{"capecId": "CAPEC-7", "descriptions": [{"lang": "en", "value": "CAPEC-7 Blind SQL Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-09-02T12:25:47.833Z"}, "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-1376"}], "source": {"advisory": "TR-24-1376", "defect": ["TR-24-1376"], "discovery": "UNKNOWN"}, "tags": ["unsupported-when-assigned"], "title": "SQLi in NAC Telecommunication's NACPremium", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "nac_telecommunication_systems", "product": "nacpremium", "cpes": ["cpe:2.3:a:nac_telecommunication_systems:nacpremium:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "01082024", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-03T15:40:33.556673Z", "id": "CVE-2024-6919", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T15:42:01.444Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-6919 (string)

assignerOrgId : ca940d4e-fea4-4aa2-9a58-591a58b1ce21 (string)

state : PUBLISHED (string)

assignerShortName : TR-CERT (string)

dateReserved : 2024-07-19T14:25:13.339Z (string)

datePublished : 2024-09-02T12:25:47.833Z (string)

dateUpdated : 2024-09-03T15:42:01.444Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : NACPremium (string)

vendor : NAC Telecommunication Systems Inc. (string)

versions : [ »

0 : { »

lessThanOrEqual : 01082024 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Pınar TAŞĞIN (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.<p>This issue affects NACPremium: through 01082024.</p> (string)

}

]

value : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.This issue affects NACPremium: through 01082024. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-7 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-7 Blind SQL Injection (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

Automatable : YES (string)

Recovery : USER (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

baseScore : 9.3 (number)

baseSeverity : CRITICAL (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

subIntegrityImpact : NONE (string)

userInteraction : NONE (string)

valueDensity : CONCENTRATED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L (string)

version : 4.0 (string)

vulnAvailabilityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

vulnIntegrityImpact : HIGH (string)

vulnerabilityResponseEffort : LOW (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-89 (string)

description : CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : ca940d4e-fea4-4aa2-9a58-591a58b1ce21 (string)

shortName : TR-CERT (string)

dateUpdated : 2024-09-02T12:25:47.833Z (string)

}

references : [ »

0 : { »

url : https://www.usom.gov.tr/bildirim/tr-24-1376 (string)

}

]

source : { »

advisory : TR-24-1376 (string)

defect : [ »

0 : TR-24-1376 (string)

]

discovery : UNKNOWN (string)

}

tags : [ »

0 : unsupported-when-assigned (string)

]

title : SQLi in NAC Telecommunication's NACPremium (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : nac_telecommunication_systems (string)

product : nacpremium (string)

cpes : [ »

0 : cpe:2.3:a:nac_telecommunication_systems:nacpremium:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 01082024 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-03T15:40:33.556673Z (string)

id : CVE-2024-6919 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-03T15:42:01.444Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6919", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-03T15:40:33.556673Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:nac_telecommunication_systems:nacpremium:*:*:*:*:*:*:*:*"], "vendor": "nac_telecommunication_systems", "product": "nacpremium", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "01082024"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T15:41:52.508Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "SQLi in NAC Telecommunication's NACPremium", "source": {"defect": ["TR-24-1376"], "advisory": "TR-24-1376", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "P\u0131nar TA\u015e\u011eIN"}], "impacts": [{"capecId": "CAPEC-7", "descriptions": [{"lang": "en", "value": "CAPEC-7 Blind SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 9.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NAC Telecommunication Systems Inc.", "product": "NACPremium", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "01082024"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-1376"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.This issue affects NACPremium: through 01082024.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.<p>This issue affects NACPremium: through 01082024.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-09-02T12:25:47.833Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6919", "state": "PUBLISHED", "dateUpdated": "2024-09-03T15:42:01.444Z", "dateReserved": "2024-07-19T14:25:13.339Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2024-09-02T12:25:47.833Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-6919 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-03T15:40:33.556673Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:nac_telecommunication_systems:nacpremium:*:*:*:*:*:*:*:* (string)

]

vendor : nac_telecommunication_systems (string)

product : nacpremium (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 01082024 (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-03T15:41:52.508Z (string)

}

]

cna : { »

tags : [ »

0 : unsupported-when-assigned (string)

]

title : SQLi in NAC Telecommunication's NACPremium (string)

source : { »

defect : [ »

0 : TR-24-1376 (string)

]

advisory : TR-24-1376 (string)

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Pınar TAŞĞIN (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-7 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-7 Blind SQL Injection (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV4_0 : { »

Safety : NOT_DEFINED (string)

version : 4.0 (string)

Recovery : USER (string)

baseScore : 9.3 (number)

Automatable : YES (string)

attackVector : NETWORK (string)

baseSeverity : CRITICAL (string)

valueDensity : CONCENTRATED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L (string)

providerUrgency : NOT_DEFINED (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : NONE (string)

subIntegrityImpact : NONE (string)

vulnIntegrityImpact : HIGH (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

vulnerabilityResponseEffort : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : NAC Telecommunication Systems Inc. (string)

product : NACPremium (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 01082024 (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://www.usom.gov.tr/bildirim/tr-24-1376 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.This issue affects NACPremium: through 01082024. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.<p>This issue affects NACPremium: through 01082024.</p> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-89 (string)

description : CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (string)

}

]

}

]

providerMetadata : { »

orgId : ca940d4e-fea4-4aa2-9a58-591a58b1ce21 (string)

shortName : TR-CERT (string)

dateUpdated : 2024-09-02T12:25:47.833Z (string)

}

cveMetadata : { »

cveId : CVE-2024-6919 (string)

state : PUBLISHED (string)

dateUpdated : 2024-09-03T15:42:01.444Z (string)

dateReserved : 2024-07-19T14:25:13.339Z (string)

assignerOrgId : ca940d4e-fea4-4aa2-9a58-591a58b1ce21 (string)

datePublished : 2024-09-02T12:25:47.833Z (string)

assignerShortName : TR-CERT (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nac:nacpremium:*:*:*:*:*:*:*:*", "matchCriteriaId": "B0B64BE0-5BC9-437D-BE0B-35C94A24BBD4", "versionEndIncluding": "2024-08-01", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "iletisim@usom.gov.tr", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.This issue affects NACPremium: through 01082024."}, {"lang": "es", "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando SQL ('Inyecci\u00f3n SQL') en NAC Telecommunication Systems Inc. NACPremium permite la inyecci\u00f3n SQL ciega. Este problema afecta a NACPremium: hasta el 01082024."}], "id": "CVE-2024-6919", "lastModified": "2024-09-17T15:57:38.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "YES", "availabilityRequirements": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "USER", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:X", "version": "4.0", "vulnerabilityResponseEffort": "LOW", "vulnerableSystemAvailability": "NONE", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "HIGH"}, "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}, "published": "2024-09-02T18:15:38.290", "references": [{"source": "iletisim@usom.gov.tr", "tags": ["Broken Link"], "url": "https://www.usom.gov.tr/bildirim/tr-24-1376"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "iletisim@usom.gov.tr", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:nac:nacpremium:*:*:*:*:*:*:*:* (string)

matchCriteriaId : B0B64BE0-5BC9-437D-BE0B-35C94A24BBD4 (string)

versionEndIncluding : 2024-08-01 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ »

0 : { »

sourceIdentifier : iletisim@usom.gov.tr (string)

tags : [ »

0 : unsupported-when-assigned (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.This issue affects NACPremium: through 01082024. (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando SQL ('Inyección SQL') en NAC Telecommunication Systems Inc. NACPremium permite la inyección SQL ciega. Este problema afecta a NACPremium: hasta el 01082024. (string)

}

]

id : CVE-2024-6919 (string)

lastModified : 2024-09-17T15:57:38.043 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

cvssMetricV40 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

automatable : YES (string)

availabilityRequirements : NOT_DEFINED (string)

baseScore : 9.3 (number)

baseSeverity : CRITICAL (string)

confidentialityRequirements : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirements : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubsequentSystemAvailability : NOT_DEFINED (string)

modifiedSubsequentSystemConfidentiality : NOT_DEFINED (string)

modifiedSubsequentSystemIntegrity : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnerableSystemAvailability : NOT_DEFINED (string)

modifiedVulnerableSystemConfidentiality : NOT_DEFINED (string)

modifiedVulnerableSystemIntegrity : NOT_DEFINED (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

recovery : USER (string)

safety : NOT_DEFINED (string)

subsequentSystemAvailability : NONE (string)

subsequentSystemConfidentiality : NONE (string)

subsequentSystemIntegrity : NONE (string)

userInteraction : NONE (string)

valueDensity : CONCENTRATED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:X (string)

version : 4.0 (string)

vulnerabilityResponseEffort : LOW (string)

vulnerableSystemAvailability : NONE (string)

vulnerableSystemConfidentiality : HIGH (string)

vulnerableSystemIntegrity : HIGH (string)

}

source : iletisim@usom.gov.tr (string)

type : Secondary (string)

}

]

}

published : 2024-09-02T18:15:38.290 (string)

references : [ »

0 : { »

source : iletisim@usom.gov.tr (string)

tags : [ »

0 : Broken Link (string)

]

url : https://www.usom.gov.tr/bildirim/tr-24-1376 (string)

}

]

sourceIdentifier : iletisim@usom.gov.tr (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-89 (string)

}

]

source : iletisim@usom.gov.tr (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object