| Vulnerability Name: | CVE-2014-2949 (CCN-93866) | ||||||||
| Assigned: | 2014-06-17 | ||||||||
| Published: | 2014-06-17 | ||||||||
| Updated: | 2015-12-04 | ||||||||
| Summary: | SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | ||||||||
| CVSS v3 Severity: | 5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P) 6.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:H/RL:U/RC:C)
6.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:H/RL:U/RC:C)
| ||||||||
| Vulnerability Type: | CWE-89 | ||||||||
| Vulnerability Consequences: | Data Manipulation | ||||||||
| References: | Source: MITRE Type: CNA CVE-2014-2949 Source: CCN Type: F5 Networks Support Web site SOL15310 - Data Manager SQL Injection Remote Code Execution vulnerability CVE-2014-2949 Source: CONFIRM Type: Vendor Advisory http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15310.html?sr=38021626 Source: CCN Type: US-CERT VU#210884 F5 ARX Data Manager contains a SQL injection vulnerability Source: CERT-VN Type: Third Party Advisory, US Government Resource VU#210884 Source: CCN Type: OSVDB ID: 108220 F5 ARX Data Manager Unspecified SQL Injection Source: BID Type: UNKNOWN 68078 Source: CCN Type: BID-68078 F5 Networks ARX Data Manager CVE-2014-2949 SQL Injection Vulnerabilitiy Source: MISC Type: UNKNOWN http://www.zerodayinitiative.com/advisories/ZDI-14-293/ Source: XF Type: UNKNOWN f5-arxdatamanager-cve20142949-sql-injection(93866) Source: CCN Type: F5 Web site ARX Data Manager Source: CCN Type: ZDI-14-293 (0Day) F5 Data Manager discoverFilerBasicInfo.jsft filerName SQL Injection Remote Code Execution Vulnerability | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||