CVE-2017-20150

A vulnerability was found in challenge website. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The name of the patch is f1644b1d3502e5aa5284f31ea80d2623817f4d42. It is recommended to apply a patch to fix this issue. The identifier VDB-216989 was assigned to this vulnerability.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/Challenge/website/commit/f1644b1d3502e5aa5284f31ea80d2623817f4d42	Patch Third Party Advisory
https://vuldb.com/?ctiid.216989	Permissions Required Third Party Advisory
https://vuldb.com/?id.216989	Permissions Required Third Party Advisory
https://github.com/Challenge/website/commit/f1644b1d3502e5aa5284f31ea80d2623817f4d42	Patch Third Party Advisory
https://vuldb.com/?ctiid.216989	Permissions Required Third Party Advisory
https://vuldb.com/?id.216989	Permissions Required Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:challenge_website_project:challenge_website:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:22

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~8.8~~	v2 : unknown v3 : 5.5
References	~~() https://github.com/Challenge/website/commit/f1644b1d3502e5aa5284f31ea80d2623817f4d42 - Patch, Third Party Advisory~~	() https://github.com/Challenge/website/commit/f1644b1d3502e5aa5284f31ea80d2623817f4d42 - Patch, Third Party Advisory
References	~~() https://vuldb.com/?ctiid.216989 - Permissions Required, Third Party Advisory~~	() https://vuldb.com/?ctiid.216989 - Permissions Required, Third Party Advisory
References	~~() https://vuldb.com/?id.216989 - Permissions Required, Third Party Advisory~~	() https://vuldb.com/?id.216989 - Permissions Required, Third Party Advisory

Information

Published : 2022-12-28 19:15

Updated : 2024-11-21 03:22

NVD link : CVE-2017-20150

Mitre link : CVE-2017-20150

CVE.ORG link : CVE-2017-20150

JSON object : View

Products Affected

challenge_website_project

challenge_website

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2017-20150", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-12-28T19:15:08.837", "references": [{"url": "https://github.com/Challenge/website/commit/f1644b1d3502e5aa5284f31ea80d2623817f4d42", "tags": ["Patch", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.216989", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.216989", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://github.com/Challenge/website/commit/f1644b1d3502e5aa5284f31ea80d2623817f4d42", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?ctiid.216989", "tags": ["Permissions Required", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?id.216989", "tags": ["Permissions Required", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in challenge website. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The name of the patch is f1644b1d3502e5aa5284f31ea80d2623817f4d42. It is recommended to apply a patch to fix this issue. The identifier VDB-216989 was assigned to this vulnerability."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el sitio web Challenge. Ha sido calificado como cr\u00edtico. Este problema afecta alg\u00fan procesamiento desconocido. La manipulaci\u00f3n conduce a la inyecci\u00f3n de SQL. El nombre del parche es f1644b1d3502e5aa5284f31ea80d2623817f4d42. Se recomienda aplicar un parche para solucionar este problema. A esta vulnerabilidad se le asign\u00f3 el identificador VDB-216989."}], "lastModified": "2024-11-21T03:22:45.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:challenge_website_project:challenge_website:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EB8742B-DB30-4331-BF7F-25FF8602A129", "versionEndExcluding": "2017-01-24"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}