CVE-2010-0115 - Vulnerability Details - OpenCVE

SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Symantec	Web Gateway Web Gateway Appliance

Configuration 1 [-]

AND

OR	cpe:2.3:a:symantec:web_gateway:4.5:::::::*
	cpe:2.3:a:symantec:web_gateway:4.5.0.325:::::::*
	cpe:2.3:a:symantec:web_gateway:4.5.0.326:::::::*
	cpe:2.3:a:symantec:web_gateway:4.5.0.327:::::::*

cpe:2.3:h:symantec:web_gateway_appliance:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://osvdb.org/70415
http://secunia.com/advisories/42878
http://www.securityfocus.com/bid/45742
http://www.securitytracker.com/id?1024958
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110112_00
http://www.vupen.com/english/advisories/2011/0088
http://www.zerodayinitiative.com/advisories/ZDI-11-013/
https://exchange.xforce.ibmcloud.com/vulnerabilities/64658

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2011-01-14T22:00:00

Updated: 2024-08-07T00:37:53.896Z

Reserved: 2009-12-31T00:00:00

Link: CVE-2010-0115

Vulnrichment

No data.

NVD

Status : Modified

Published: 2011-01-14T23:00:44.100

Modified: 2024-11-21T01:11:33.983

Link: CVE-2010-0115

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2011-01-12T00:00:00", "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110112_00"}, {"name": "45742", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/45742"}, {"name": "ADV-2011-0088", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2011/0088"}, {"name": "symantec-web-username-sql-injection(64658)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64658"}, {"name": "42878", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/42878"}, {"tags": ["x_refsource_MISC"], "url": "http://www.zerodayinitiative.com/advisories/ZDI-11-013/"}, {"name": "70415", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/70415"}, {"name": "1024958", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1024958"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2010-0115", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110112_00", "refsource": "CONFIRM", "url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110112_00"}, {"name": "45742", "refsource": "BID", "url": "http://www.securityfocus.com/bid/45742"}, {"name": "ADV-2011-0088", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2011/0088"}, {"name": "symantec-web-username-sql-injection(64658)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64658"}, {"name": "42878", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/42878"}, {"name": "http://www.zerodayinitiative.com/advisories/ZDI-11-013/", "refsource": "MISC", "url": "http://www.zerodayinitiative.com/advisories/ZDI-11-013/"}, {"name": "70415", "refsource": "OSVDB", "url": "http://osvdb.org/70415"}, {"name": "1024958", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1024958"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T00:37:53.896Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110112_00"}, {"name": "45742", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/45742"}, {"name": "ADV-2011-0088", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2011/0088"}, {"name": "symantec-web-username-sql-injection(64658)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64658"}, {"name": "42878", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/42878"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.zerodayinitiative.com/advisories/ZDI-11-013/"}, {"name": "70415", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/70415"}, {"name": "1024958", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1024958"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2010-0115", "datePublished": "2011-01-14T22:00:00", "dateReserved": "2009-12-31T00:00:00", "dateUpdated": "2024-08-07T00:37:53.896Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:symantec:web_gateway:4.5:*:*:*:*:*:*:*", "matchCriteriaId": "CF4488B0-2DDE-46A9-BC01-9676D96B1714", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:web_gateway:4.5.0.325:*:*:*:*:*:*:*", "matchCriteriaId": "A3229237-2210-4353-B319-91CB6C9B631F", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:web_gateway:4.5.0.326:*:*:*:*:*:*:*", "matchCriteriaId": "785F35C9-A23C-4467-9944-135D268415A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:web_gateway:4.5.0.327:*:*:*:*:*:*:*", "matchCriteriaId": "78E6B913-3B79-420E-9EB8-CE138B7C7ADE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:symantec:web_gateway_appliance:*:*:*:*:*:*:*:*", "matchCriteriaId": "69DC5AE4-51A8-4F07-BAD9-F234130CB4D5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n SQL en login.php en la GUI de administraci\u00f3n de la consola de Symantec Web Gateway 4.5 antes de v4.5.0.376 permite a atacantes remotos ejecutar comandos SQL a trav\u00e9s del par\u00e1metro USERNAME."}], "id": "CVE-2010-0115", "lastModified": "2024-11-21T01:11:33.983", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2011-01-14T23:00:44.100", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/70415"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/42878"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/45742"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1024958"}, {"source": "cve@mitre.org", "url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110112_00"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2011/0088"}, {"source": "cve@mitre.org", "url": "http://www.zerodayinitiative.com/advisories/ZDI-11-013/"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64658"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/70415"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/42878"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/45742"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1024958"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110112_00"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2011/0088"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.zerodayinitiative.com/advisories/ZDI-11-013/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64658"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}