CVE-2020-36530 SevOne Network Management System Alert Summary sql injection
Remote attackers can exploit SQL injection in the Alert Summary feature of SevOne Network Management System to read or modify data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36530?
CVE-2020-36530 is a medium-severity SQL injection vulnerability in SevOne Network Management System, published on 3 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability classified as critical was found in SevOne Network Management System up to 5.7.2.22. This vulnerability affects the Alert Summary. The manipulation leads to sql injection. The attack can be initiated remotely.
Weakness: CWE-89
Which versions are affected by CVE-2020-36530?
It affects 1 product.
Products include Ibm Sevone Network Performance Management.
How do I fix CVE-2020-36530?
No fix has been published for CVE-2020-36530 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-36530 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36530 exists.
Other vulnerabilities in SevOne Network Management System
Sources
Also known as GHSA-5qgf-rhj8-4jj5.