CVE-2014-4858

Estado: ModificadaAlta (7.5)—

Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.

CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.31%
Percentil entre todas las CVEs puntuadas: 70
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Sabreairlinesolutions — Crew Management Sabreairlinesolutions — Crew Operations Sabreairlinesolutions — Crew Planning Sabreairlinesolutions — Crew Services Sabreairlinesolutions — Crew Training

CWE

CWE-89

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2014-4858",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-07-26T11:11:57.457",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/394540",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/68899",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/394540",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/68899",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de inyección SQL en CWPLogin.aspx en los productos Sabre AirCentre Crew 2010.2.12.20008 y anteriores permiten a atacantes remotos ejecutar comandos SQL arbitrarios a través del campo (1) username o (2) password."
    }
  ],
  "lastModified": "2026-06-17T00:10:42.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sabreairlinesolutions:crew_management:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E19F7C38-5DB0-4CCA-8403-FFE371B8834B",
              "versionEndIncluding": "2010.2.12.20008"
            },
            {
              "criteria": "cpe:2.3:a:sabreairlinesolutions:crew_operations:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8B3E8AF-1266-4733-963E-0483E611F0D3",
              "versionEndIncluding": "2010.2.12.20008"
            },
            {
              "criteria": "cpe:2.3:a:sabreairlinesolutions:crew_planning:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C542871C-2B47-4B79-8921-25190C878176",
              "versionEndIncluding": "2010.2.12.20008"
            },
            {
              "criteria": "cpe:2.3:a:sabreairlinesolutions:crew_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FCABEDB-434C-4380-967F-3665E2FF17DD",
              "versionEndIncluding": "2010.2.12.20008"
            },
            {
              "criteria": "cpe:2.3:a:sabreairlinesolutions:crew_training:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69D7DD5B-F291-4D3C-A28E-B2E069573701",
              "versionEndIncluding": "2010.2.12.20008"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}