// For flags

CVE-2017-15329

 

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Huawei UMA V200R001C00 has a SQL injection vulnerability in the operation and maintenance module. An attacker logs in to the system as a common user and sends crafted HTTP requests that contain malicious SQL statements to the affected system. Due to a lack of input validation on HTTP requests that contain user-supplied input, successful exploitation may allow the attacker to execute arbitrary SQL queries.

Huawei UMA V200R001C00 tiene una vulnerabilidad de inyección SQL en el módulo de operación y mantenimiento. Un atacante inicia sesión en el sistema como usuario común y envía peticiones HTTP manipuladas que contienen instrucciones SQL al sistema afectado. Debido a la falta de validación de entradas de peticiones HTTP que contienen entradas proporcionadas por el usuario, la explotación con éxito podría permitir que el atacante ejecute consultas SQL arbitrarias.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-10-14 CVE Reserved
  • 2018-02-15 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Huawei
Search vendor "Huawei"
 Uma Firmware
Search vendor "Huawei" for product "Uma Firmware"
 v200r001c00
Search vendor "Huawei" for product "Uma Firmware" and version "v200r001c00"
-
Affected
in Huawei
Search vendor "Huawei"
 Uma
Search vendor "Huawei" for product "Uma"
--
Safe