CVE-2019-5278 Denial of service in CampusInsight

Medium 6.5 Published 13 Dec 2019 Updated 4 Aug 2024

Attackers with specific permissions can crash the Gauss100 OLTP database via out-of-bounds read in Advanced Packages using crafted SQL.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-5278?

CVE-2019-5278 is a medium-severity denial of service vulnerability in CampusInsight, published on 13 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database in CampusInsight before V100R019C00SPC200. Attackers who gain the specific permission can use this vulnerability by sending elaborate SQL statements to the database. Successful exploit of this vulnerability may cause the database to crash.

Weakness: CWE-125

Which versions are affected by CVE-2019-5278?

It affects 1 product.

Products include Huawei Campusinsight.

How do I fix CVE-2019-5278?

No fix has been published for CVE-2019-5278 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-5278 being exploited?

There is no known exploitation of CVE-2019-5278 in the wild and no public exploit code.

Sources

Also known as GHSA-v7mh-vm24-5fjf.