Netentsec NS-ASG Application Security Gateway 6.3 listloginfo.php Injecção SQL

Uma vulnerabilidade classificada como crítico foi encontrada em Netentsec NS-ASG Application Security Gateway 6.3. Afectado é uma função desconhecida do ficheiro /protocol/log/listloginfo.php. A manipulação com uma entrada desconhecida leva a Injecção SQL. Usar a CWE para declarar o problema leva à CWE-89. O aconselhamento é partilhado para download em github.com. A vulnerabilidade é identificada como CVE-2024-3041. O ataque pode ser feito a partir da rede. Os detalhes técnicos estão disponíveis. Além disso, há uma exploração disponível. A exploração foi divulgada ao público e pode ser utilizada. Esta vulnerabilidade é atribuída a T1505 pelo projecto MITRE ATT&CK. É declarado como proof-of-concept. É possível descarregar a exploração em github.com. Como 0 dia, o preço estimado do subsolo foi de cerca de $0-$5k.

Campo28/03/2024 10h2806/05/2024 16h2006/05/2024 16h28
cvss3_meta_tempscore5.75.76.0
cvss4_vuldb_bscore5.35.35.3
cvss4_vuldb_btscore2.12.12.1
price_0day$0-$5k$0-$5k$0-$5k
nameNS-ASG Application Security GatewayNS-ASG Application Security GatewayNS-ASG Application Security Gateway
version6.36.36.3
file/protocol/log/listloginfo.php/protocol/log/listloginfo.php/protocol/log/listloginfo.php
cwe89 (Injecção SQL)89 (Injecção SQL)89 (Injecção SQL)
risk222
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_ePPP
cvss3_vuldb_rcRRR
urlhttps://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-listloginfo.mdhttps://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-listloginfo.mdhttps://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-listloginfo.md
availability111
publicity111
urlhttps://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-listloginfo.mdhttps://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-listloginfo.mdhttps://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-listloginfo.md
cveCVE-2024-3041CVE-2024-3041CVE-2024-3041
responsibleVulDBVulDBVulDB
response_summaryThe vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.
date1711580400 (28/03/2024)1711580400 (28/03/2024)1711580400 (28/03/2024)
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss4_vuldb_avNNN
cvss4_vuldb_acLLL
cvss4_vuldb_uiNNN
cvss4_vuldb_vcLLL
cvss4_vuldb_viLLL
cvss4_vuldb_vaLLL
cvss4_vuldb_ePPP
cvss2_vuldb_auSSS
cvss2_vuldb_rlNDNDND
cvss3_vuldb_prLLL
cvss3_vuldb_rlXXX
cvss4_vuldb_atNNN
cvss4_vuldb_prLLL
cvss4_vuldb_scNNN
cvss4_vuldb_siNNN
cvss4_vuldb_saNNN
cvss2_vuldb_basescore6.56.56.5
cvss2_vuldb_tempscore5.65.65.6
cvss3_vuldb_basescore6.36.36.3
cvss3_vuldb_tempscore5.75.75.7
cvss3_meta_basescore6.36.36.3
vendorNetentsecNetentsecNetentsec
cve_assigned1711580400 (28/03/2024)1711580400 (28/03/2024)
cve_nvd_summaryA vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the file /protocol/log/listloginfo.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258430 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the file /protocol/log/listloginfo.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258430 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
cvss2_nvd_avN
cvss2_nvd_acL
cvss2_nvd_auS
cvss2_nvd_ciP
cvss2_nvd_iiP
cvss2_nvd_aiP
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cL
cvss3_cna_iL
cvss3_cna_aL
cve_cnaVulDB
cvss2_nvd_basescore6.5
cvss3_cna_basescore6.3

◂ VoltarVisão GeralPróximo ▸

Interested in the pricing of exploits?

See the underground prices here!