Vulnerability-Lookup

CNVD-2019-36673

Vulnerability from cnvd - Published: 2019-10-22

Title

Palo Alto Networks Zingbox Inspector SQL注入漏洞

Description

Palo Alto Networks Zingbox Inspector是美国Palo Alto Networks公司的一款Zingbox IoT Command Center物联网控制中心解决方案中的本地部署设备。 Palo Alto Networks Zingbox Inspector 1.288及之前版本中的管理界面存在SQL注入漏洞。该漏洞源于基于数据库的应用缺少对外部输入SQL语句的验证。攻击者可利用该漏洞执行非法SQL命令。

Severity

中

Patch Name

Palo Alto Networks Zingbox Inspector SQL注入漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://securityadvisories.paloaltonetworks.com/Home/Detail/173

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-15016

Impacted products

Name
Palo Alto Networks Zingbox Inspector <=1.288

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-15016",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-15016"
    }
  },
  "description": "Palo Alto Networks Zingbox Inspector\u662f\u7f8e\u56fdPalo Alto Networks\u516c\u53f8\u7684\u4e00\u6b3eZingbox IoT Command Center\u7269\u8054\u7f51\u63a7\u5236\u4e2d\u5fc3\u89e3\u51b3\u65b9\u6848\u4e2d\u7684\u672c\u5730\u90e8\u7f72\u8bbe\u5907\u3002\n\nPalo Alto Networks Zingbox Inspector 1.288\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u7684\u7ba1\u7406\u754c\u9762\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u57fa\u4e8e\u6570\u636e\u5e93\u7684\u5e94\u7528\u7f3a\u5c11\u5bf9\u5916\u90e8\u8f93\u5165SQL\u8bed\u53e5\u7684\u9a8c\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u975e\u6cd5SQL\u547d\u4ee4\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://securityadvisories.paloaltonetworks.com/Home/Detail/173",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-36673",
  "openTime": "2019-10-22",
  "patchDescription": "Palo Alto Networks Zingbox Inspector\u662f\u7f8e\u56fdPalo Alto Networks\u516c\u53f8\u7684\u4e00\u6b3eZingbox IoT Command Center\u7269\u8054\u7f51\u63a7\u5236\u4e2d\u5fc3\u89e3\u51b3\u65b9\u6848\u4e2d\u7684\u672c\u5730\u90e8\u7f72\u8bbe\u5907\u3002\r\nPalo Alto Networks Zingbox Inspector 1.288\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u7684\u7ba1\u7406\u754c\u9762\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u57fa\u4e8e\u6570\u636e\u5e93\u7684\u5e94\u7528\u7f3a\u5c11\u5bf9\u5916\u90e8\u8f93\u5165SQL\u8bed\u53e5\u7684\u9a8c\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u975e\u6cd5SQL\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Palo Alto Networks Zingbox Inspector SQL\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Palo Alto Networks Zingbox Inspector \u003c=1.288"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-15016",
  "serverity": "\u4e2d",
  "submitTime": "2019-10-21",
  "title": "Palo Alto Networks Zingbox Inspector SQL\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2019-15016 (GCVE-0-2019-15016)

Vulnerability from cvelistv5 – Published: 2019-10-09 20:20 – Updated: 2024-08-05 00:34

Summary

An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database.

Severity

No CVSS data available.

CWE

SQL Injection

Assigner

palo_alto

References

1 reference

URL	Tags
https://security.paloaltonetworks.com/CVE-2019-15016	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Palo Alto Networks Zingbox Inspector	Affected: Zingbox Inspector, versions 1.288 and earlier.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:34:53.168Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2019-15016"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Palo Alto Networks Zingbox Inspector",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Zingbox Inspector, versions 1.288 and earlier."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "SQL Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T16:03:47.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2019-15016"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "ID": "CVE-2019-15016",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Palo Alto Networks Zingbox Inspector",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Zingbox Inspector, versions 1.288 and earlier."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.paloaltonetworks.com/CVE-2019-15016",
              "refsource": "MISC",
              "url": "https://security.paloaltonetworks.com/CVE-2019-15016"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2019-15016",
    "datePublished": "2019-10-09T20:20:28.000Z",
    "dateReserved": "2019-08-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:34:53.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-36673

CVE-2019-15016 (GCVE-0-2019-15016)

Tags

Sightings

Nomenclature