by Kastro
Paper/Archive/CVE-2021-22851

CVE-2021-22851

HGiga OAKSv20 OAKlouds-document_v3 2.0 — HGiga OAKloud Portal - SQL injection -1

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 67.4.674 × 2013.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data.

Affected

ProductAffectedFixed inSource
OAKSv20 OAKlouds-document_v3 2.0unspecified – < 2.0-542.0-54CNA
OAKSv30 OAKlouds-document_v3 3.0unspecified – < 3.0-543.0-54CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refchtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daefreftwcert.org.tw/tw/cp-132-4327-50e99-1.html