VulnerabilityModified
CVE-2014-4858
Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.
HIGH 7.5EPSS 1.31%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.31% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- sabreairlinesolutions/crew management · sabreairlinesolutions/crew operations · sabreairlinesolutions/crew planning · sabreairlinesolutions/crew services · sabreairlinesolutions/crew training
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/394540Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/68899
- http://www.kb.cert.org/vuls/id/394540Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/68899
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.