CVE-2010-0712

Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://dev.zenoss.org/trac/changeset/15257	Vendor Advisory
http://osvdb.org/61804
http://secunia.com/advisories/38195	Vendor Advisory
http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-001-zenoss-getjsoneventsinfo-sql-injection/
http://www.securityfocus.com/bid/37802	Exploit
http://www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.html	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/55670
http://dev.zenoss.org/trac/changeset/15257	Vendor Advisory
http://osvdb.org/61804
http://secunia.com/advisories/38195	Vendor Advisory
http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-001-zenoss-getjsoneventsinfo-sql-injection/
http://www.securityfocus.com/bid/37802	Exploit
http://www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.html	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/55670

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zenoss:zenoss::::::::
	cpe:2.3:a:zenoss:zenoss:2.3.0:::::::*
	cpe:2.3:a:zenoss:zenoss:2.3.3:::::::*
	cpe:2.3:a:zenoss:zenoss:2.4.0:::::::*
	cpe:2.3:a:zenoss:zenoss:2.4.2:::::::*

History

No history.

Information

Published : 2010-02-26 17:30

Updated : 2025-04-11 00:51

NVD link : CVE-2010-0712

Mitre link : CVE-2010-0712

CVE.ORG link : CVE-2010-0712

JSON object : View

Products Affected

zenoss

zenoss

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2010-0712", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-02-26T17:30:01.437", "references": [{"url": "http://dev.zenoss.org/trac/changeset/15257", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://osvdb.org/61804", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/38195", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-001-zenoss-getjsoneventsinfo-sql-injection/", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/37802", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55670", "source": "cve@mitre.org"}, {"url": "http://dev.zenoss.org/trac/changeset/15257", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://osvdb.org/61804", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/38195", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-001-zenoss-getjsoneventsinfo-sql-injection/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/37802", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55670", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en zport/dmd/Events/getJSONEventsInfo en Zenoss v2.3.3 y otras versiones anteriores a v2.5, permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros (1) severity, (2) state, (3) filter, (4) offset, and (5) count."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zenoss:zenoss:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBA85D42-8728-4F06-B022-D7C9D6F164D6", "versionEndIncluding": "2.4.5"}, {"criteria": "cpe:2.3:a:zenoss:zenoss:2.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79743C9D-B693-4C9D-B427-AB836C4BC15A"}, {"criteria": "cpe:2.3:a:zenoss:zenoss:2.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88C2F7E5-D7FD-4738-9E17-CD8387C79BE6"}, {"criteria": "cpe:2.3:a:zenoss:zenoss:2.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47B28CD5-C60A-48DF-9081-C53125DAEB09"}, {"criteria": "cpe:2.3:a:zenoss:zenoss:2.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EFB19D9-8C3E-41E3-AEA9-8C97E66C1CD7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}