CVE-2014-3138

Published May 2, 2014

Last updated 7 years ago

Overview

Description: SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of these details are obtained from third party information.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.5
Impact score: 6.4
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-89

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:xerox:docushare:6.5.3:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7EA39474-5CF8-46E0-8BD1-1AAD923C705F"
          },
          {
            "criteria": "cpe:2.3:a:xerox:docushare:6.5.3:patch6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "79F24561-B977-4B88-A0A0-69BBD70AFA9F"
          },
          {
            "criteria": "cpe:2.3:a:xerox:docushare:6.6.1:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F0CC154E-6DEF-4459-AF02-C8B3A21416D2"
          },
          {
            "criteria": "cpe:2.3:a:xerox:docushare:6.6.1:update1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "67B405F4-986D-4585-BDC4-A9CD03B2BE91"
          },
          {
            "criteria": "cpe:2.3:a:xerox:docushare:6.6.1:update2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "230B2172-24CF-4871-835A-9425452F4B1A"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References