CVE-2021-3286 - SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used

Back Back to CVE browser

CRITICAL

SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used

Published Jan 24, 2021

9.8

CRITICAL

CVSS 3.1

EPSS 1.03%

Description

SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used. NOTE: this issue exists because of an incomplete fix for CVE-2020-35545.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-26621
Advisory
https://github.com/spotweb/spotweb/issues/653
x_refsource_MISCIssue TrackingThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-26621		Advisory
https://github.com/spotweb/spotweb/issues/653		x_refsource_MISCIssue TrackingThird Party Advisory