CVE-2018-14956 Information

Description

CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws. An attacker can inject malicious queries into the application and obtain sensitive information.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

http://packetstormsecurity.com/files/149571/CMS-ISWEB-3.5.3-SQL-Injection.html https://cxsecurity.com/issue/WLB-2018090249 https://exchange.xforce.ibmcloud.com/vulnerabilities/150516 https://imgur.com/a/buXJJKC

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8