CVE-2019-4012 - Vulnerability Details - OpenCVE

IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 155886.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	Bigfix Webui Profile Management Bigfix Webui Software Distribution

Configuration 1 [-]

OR	cpe:2.3:a:ibm:bigfix_webui_profile_management:6:::::::*
	cpe:2.3:a:ibm:bigfix_webui_software_distribution:23:::::::*

No data.

References

Link	Providers
http://www.ibm.com/support/docview.wss?uid=ibm10875490
http://www.securityfocus.com/bid/108038
https://exchange.xforce.ibmcloud.com/vulnerabilities/155886

History

No history.

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2019-04-15T14:55:26.514969Z

Updated: 2024-09-16T16:38:18.575Z

Reserved: 2019-01-03T00:00:00

Link: CVE-2019-4012

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-04-15T15:29:00.687

Modified: 2024-11-21T04:43:02.523

Link: CVE-2019-4012

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "BigFix WebUI Profile Management", "vendor": "IBM", "versions": [{"status": "affected", "version": "6"}]}, {"product": "BigFix WebUI Software Distribution", "vendor": "IBM", "versions": [{"status": "affected", "version": "23"}]}], "datePublic": "2019-04-09T00:00:00", "descriptions": [{"lang": "en", "value": "IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 155886."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "exploitCodeMaturity": "UNPROVEN", "integrityImpact": "LOW", "privilegesRequired": "LOW", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "scope": "UNCHANGED", "temporalScore": 5.5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.0/I:L/C:L/S:U/A:L/PR:L/AV:N/AC:L/UI:N/RC:C/E:U/RL:O", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Data Manipulation", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-04-23T12:06:01", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.ibm.com/support/docview.wss?uid=ibm10875490"}, {"name": "ibm-bigfix-cve20194012-sql-injection (155886)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/155886"}, {"name": "108038", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/108038"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "DATE_PUBLIC": "2019-04-09T00:00:00", "ID": "CVE-2019-4012", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "BigFix WebUI Profile Management", "version": {"version_data": [{"version_value": "6"}]}}, {"product_name": "BigFix WebUI Software Distribution", "version": {"version_data": [{"version_value": "23"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 155886."}]}, "impact": {"cvssv3": {"BM": {"A": "L", "AC": "L", "AV": "N", "C": "L", "I": "L", "PR": "L", "S": "U", "UI": "N"}, "TM": {"E": "U", "RC": "C", "RL": "O"}}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Data Manipulation"}]}]}, "references": {"reference_data": [{"name": "http://www.ibm.com/support/docview.wss?uid=ibm10875490", "refsource": "CONFIRM", "title": "IBM Security Bulletin 875490 (BigFix WebUI Software Distribution)", "url": "http://www.ibm.com/support/docview.wss?uid=ibm10875490"}, {"name": "ibm-bigfix-cve20194012-sql-injection (155886)", "refsource": "XF", "title": "X-Force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/155886"}, {"name": "108038", "refsource": "BID", "url": "http://www.securityfocus.com/bid/108038"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T19:26:27.666Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.ibm.com/support/docview.wss?uid=ibm10875490"}, {"name": "ibm-bigfix-cve20194012-sql-injection (155886)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/155886"}, {"name": "108038", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/108038"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2019-4012", "datePublished": "2019-04-15T14:55:26.514969Z", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2024-09-16T16:38:18.575Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:bigfix_webui_profile_management:6:*:*:*:*:*:*:*", "matchCriteriaId": "58EE0F69-49CA-4D80-A7CE-18E18ABDCBF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_webui_software_distribution:23:*:*:*:*:*:*:*", "matchCriteriaId": "1B1817D3-0333-49CA-B85B-62B09541D2DB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 155886."}, {"lang": "es", "value": "IBM BigFix WebUI Profile Management 6 y Software Distribution 23 son vulnerables a la inyecci\u00f3n de SQL. Un atacante remoto podr\u00eda enviar sentencias SQL especialmente dise\u00f1adas, que permitir\u00edan al atacante ver, a\u00f1adir, modificar o eliminar informaci\u00f3n en la base de datos del back-end. IBM X-Force ID: 155886."}], "id": "CVE-2019-4012", "lastModified": "2024-11-21T04:43:02.523", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "[email protected]", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2019-04-15T15:29:00.687", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=ibm10875490"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/108038"}, {"source": "[email protected]", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/155886"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=ibm10875490"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/108038"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/155886"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "[email protected]", "type": "Primary"}]}