5.5med
CVE-2017-20150
challenge website sql injection
Published 3 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 54%
Public exploits
0
none known
Summary
A vulnerability was found in challenge website. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The name of the patch is f1644b1d3502e5aa5284f31ea80d2623817f4d42. It is recommended to apply a patch to fix this issue. The identifier VDB-216989 was assigned to this vulnerability.
Exploit prediction (EPSS)
0.71% probability of exploitation in the next 30 days, higher than 54% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- challenge website
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- vuldb.com /?id.216989 · vdb-entry, x_transferred
- vuldb.com /?ctiid.216989 · signature, permissions-required, x_transferred
- github.com /Challenge/website/commit/f1644b1d3502e5aa5284f31ea80d2623817f4d42 · patch, x_transferred
Sources
- CVE List: CVE-2017-20150
- NVD: CVE-2017-20150
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.