Paper/Archive/CVE-2021-4290

CVE-2021-4290

VulDB — DHBW Fallstudie Login passport.js sql injection

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 51.5.515 × 2010.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability was found in DHBW Fallstudie. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file app/config/passport.js of the component Login. The manipulation of the argument id/email leads to sql injection. The name of the patch is 5c13c6a972ef4c07c5f35b417916e0598af9e123. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216907.

Affected

ProductAffectedFixed inSource

DHBW Fallstudien/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)5.5CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)5.5CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupvuldb.com/?id.216907 refvuldb.com/?ctiid.216907 patchgithub.com/maboehm/fallstudie/commit/5c13c6a972ef4c07c5f35b417916e0598af9e123