CVE-2011-4341
Multiple SQL injection vulnerabilities in symphony/content/content.publish.php in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter…
Does this matter?
Lower severity and a low EPSS score (2.88%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple SQL injection vulnerabilities in symphony/content/content.publish.php in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter parameter to (1) symphony/publish/comments or (2) symphony/publish/images. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks via error messages. NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.88% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- symphony-cms/symphony cms
- Source
- secalert@redhat.com
References
- http://packetstormsecurity.org/files/view/106493/symphonycms-sqlxss.txt
- http://seclists.org/bugtraq/2011/Nov/8
- http://secunia.com/advisories/46663Vendor Advisory
- http://symphony-cms.com/download/releases/version/2.2.4/
- http://www.mavitunasecurity.com/xss-and-sql-injection-vulnerabilities-in-symphony-cms/
- http://www.openwall.com/lists/oss-security/2011/11/22/9Patch
- http://www.osvdb.org/76884
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71105
- https://github.com/symphonycms/symphony-2/commit/476e4926e2773588eab10dd3036f27e1411521b5
- http://packetstormsecurity.org/files/view/106493/symphonycms-sqlxss.txt
- http://seclists.org/bugtraq/2011/Nov/8
- http://secunia.com/advisories/46663Vendor Advisory
- http://symphony-cms.com/download/releases/version/2.2.4/
- http://www.mavitunasecurity.com/xss-and-sql-injection-vulnerabilities-in-symphony-cms/
- http://www.openwall.com/lists/oss-security/2011/11/22/9Patch
- http://www.osvdb.org/76884
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71105
- https://github.com/symphonycms/symphony-2/commit/476e4926e2773588eab10dd3036f27e1411521b5
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.