CVE-2018-18286

EUVD-2018-10020
SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the changepwd interface. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 68%
Affected Products (NVD)
VendorProductVersion
mitelcmg_suite
𝑥
≤ 8.4
mitelcmg_suite
8.4:sp2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.mitel.com/-/media/mitel/pdf/security-advisories/security-bulletin-19-0003-001.pdf
https://www.mitel.com/en-gb/support/security-advisories/mitel-product-security-adivsory-19-0003-001
https://www.mitel.com/-/media/mitel/pdf/security-advisories/security-bulletin-19-0003-001.pdf
https://www.mitel.com/en-gb/support/security-advisories/mitel-product-security-adivsory-19-0003-001