« Volver al listado

CVE-2017-11508

Estado: ModificadaAlta (8.8)—

SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a diagnostic scan within SecurityCenter. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tenable — Security Center

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-11508",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vulnreport@tenable.com",
      "affectedData": [
        {
          "vendor": "Tenable",
          "product": "SecurityCenter",
          "versions": [
            {
              "status": "affected",
              "version": "5.5.0, 5.5.1 and 5.5.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-11-02T17:29:00.197",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1039804",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vulnreport@tenable.com"
    },
    {
      "url": "https://www.tenable.com/security/tns-2017-13",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vulnreport@tenable.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1039804",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tenable.com/security/tns-2017-13",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a diagnostic scan within SecurityCenter. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access."
    },
    {
      "lang": "es",
      "value": "Las versiones 5.5.0, 5.5.1 y 5.5.2 de SecurityCenter contienen una vulnerabilidad de inyección SQL que podría explotarse por un usuario autenticado con los privilegios suficientes para ejecutar análisis de diagnóstico. Un atacante podría explotar esta vulnerabilidad introduciendo una consulta SQL manipulada en el campo password de un análisis de diagnóstico en SecurityCenter. La explotación exitosa de esta vulnerabilidad podría permitir que un atacante obtenga acceso no autorizado."
    }
  ],
  "lastModified": "2026-08-17T14:50:49.470",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tenable:security_center:5.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC390B68-5241-4ED6-9F2B-85AEB88AB085"
            },
            {
              "criteria": "cpe:2.3:a:tenable:security_center:5.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1F99D76-92A2-4D2B-9396-7078E3AC27F8"
            },
            {
              "criteria": "cpe:2.3:a:tenable:security_center:5.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A64361E3-E1F2-4E09-BCCC-749378673B09"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnreport@tenable.com"
}