CVE-2024-27889
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW).
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
Existen múltiples vulnerabilidades de inyección SQL en la aplicación de informes de Arista Edge Threat Management - Arista NG Firewall (NGFW). Un usuario con derechos avanzados de acceso a la aplicación de informes puede aprovechar la inyección SQL, permitiéndole ejecutar comandos en el sistema operativo subyacente con privilegios elevados.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerability.
The specific flaw exists within the ReportEntry class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the postgres user.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-02-26 CVE Reserved
- 2024-03-04 CVE Published
- 2024-04-11 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
- CAPEC-108: Command Line Execution through SQL Injection
References (1)
URL | Tag | Source |
---|---|---|
https://https://www.arista.com/en/support/advisories-notices/security-advisory/19038-security-advisory-0093 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Arista Networks Search vendor "Arista Networks" | Arista Edge Threat Management - Arista NG Firewall (NGFW) Search vendor "Arista Networks" for product "Arista Edge Threat Management - Arista NG Firewall (NGFW)" | <= 17.0 Search vendor "Arista Networks" for product "Arista Edge Threat Management - Arista NG Firewall (NGFW)" and version " <= 17.0" | en |
Affected
|