Search
Find a vulnerability
Search criteria
2 vulnerabilities found for erp by gesio
CVE-2020-8967 (GCVE-0-2020-8967)
Vulnerability from nvd – Published: 2020-06-01 13:05 – Updated: 2024-09-16 16:42
VLAI
EPSS
VEX
Title
GESIO SQL injection vulnerability
Summary
There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information.
Severity
10 (Critical)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe-cert.es/en/early-warning/secur… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gesio (GESTIÓN INTEGRAL ONLINE, SL) | GESIO ERP |
Affected:
11.2 , < 11.2
(custom)
|
Date Public
2020-06-01 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:19:18.207Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "GESIO ERP",
"vendor": "Gesio (GESTI\u00d3N INTEGRAL ONLINE, SL)",
"versions": [
{
"lessThan": "11.2",
"status": "affected",
"version": "11.2",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Francisco Palma, Luis V\u00e1zquez and Diego Le\u00f3n."
}
],
"datePublic": "2020-06-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-01T13:05:29.000Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 11.2"
}
],
"source": {
"advisory": "INCIBE-2020-0225",
"discovery": "EXTERNAL"
},
"title": "GESIO SQL injection vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve-coordination@incibe.es",
"DATE_PUBLIC": "2020-06-01T09:00:00.000Z",
"ID": "CVE-2020-8967",
"STATE": "PUBLIC",
"TITLE": "GESIO SQL injection vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "GESIO ERP",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "11.2",
"version_value": "11.2"
}
]
}
}
]
},
"vendor_name": "Gesio (GESTI\u00d3N INTEGRAL ONLINE, SL)"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Francisco Palma, Luis V\u00e1zquez and Diego Le\u00f3n."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability",
"refsource": "CONFIRM",
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 11.2"
}
],
"source": {
"advisory": "INCIBE-2020-0225",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2020-8967",
"datePublished": "2020-06-01T13:05:29.043Z",
"dateReserved": "2020-02-13T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:42:51.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-8967 (GCVE-0-2020-8967)
Vulnerability from cvelistv5 – Published: 2020-06-01 13:05 – Updated: 2024-09-16 16:42
VLAI
EPSS
VEX
Title
GESIO SQL injection vulnerability
Summary
There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information.
Severity
10 (Critical)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe-cert.es/en/early-warning/secur… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gesio (GESTIÓN INTEGRAL ONLINE, SL) | GESIO ERP |
Affected:
11.2 , < 11.2
(custom)
|
Date Public
2020-06-01 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:19:18.207Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "GESIO ERP",
"vendor": "Gesio (GESTI\u00d3N INTEGRAL ONLINE, SL)",
"versions": [
{
"lessThan": "11.2",
"status": "affected",
"version": "11.2",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Francisco Palma, Luis V\u00e1zquez and Diego Le\u00f3n."
}
],
"datePublic": "2020-06-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-01T13:05:29.000Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 11.2"
}
],
"source": {
"advisory": "INCIBE-2020-0225",
"discovery": "EXTERNAL"
},
"title": "GESIO SQL injection vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve-coordination@incibe.es",
"DATE_PUBLIC": "2020-06-01T09:00:00.000Z",
"ID": "CVE-2020-8967",
"STATE": "PUBLIC",
"TITLE": "GESIO SQL injection vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "GESIO ERP",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "11.2",
"version_value": "11.2"
}
]
}
}
]
},
"vendor_name": "Gesio (GESTI\u00d3N INTEGRAL ONLINE, SL)"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Francisco Palma, Luis V\u00e1zquez and Diego Le\u00f3n."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability",
"refsource": "CONFIRM",
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 11.2"
}
],
"source": {
"advisory": "INCIBE-2020-0225",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2020-8967",
"datePublished": "2020-06-01T13:05:29.043Z",
"dateReserved": "2020-02-13T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:42:51.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}