VulnerabilityDeferred

CVE-2024-42844

A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232.

HIGH 8.1EPSS 0.42%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.42%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232. This vulnerability allows authenticated remote attackers to execute arbitrary SQL commands through unsanitized user input fields to obtain unauthorized information

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.42% probability · 36th percentile
CISA KEV: Not listed
Weakness: CWE-89
Source: cve@mitre.org

References

https://gist.github.com/getHecked/dc4ae46526d181d3deb17092815b9bec

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.