by Kastro
Paper/Archive/CVE-2021-37749

CVE-2021-37749

mitre — MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 (aka 16.6.2.66) allows blind SQL Injection via the Id (within sourceItems)…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 79.0.790 × 2015.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 (aka 16.6.2.66) allows blind SQL Injection via the Id (within sourceItems) parameter to the GetMap method.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refhexagongeospatial.com/products/power-portfolio/geomedia-webmaprefdownload.hexagongeospatial.com/en/downloads/webgis/geomedia-webmap-2020-update-2refsilentgrid.com/blog/cve-2021-37749-hexagon-geomedia-webmap-2020-blind-sql-injection