« Volver al listado

CVE-2018-6493

Estado: ModificadaAlta (8.8)—

SQL Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be remotely exploited to allow Remote SQL Injection.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

HP — Network AutomationHP — Network Operations Management Ultimate

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-6493",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@opentext.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 8.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2.2
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "Micro Focus",
          "product": "Network Operations Management Ultimate",
          "versions": [
            {
              "status": "affected",
              "version": "2017.07, 2017.11, 2018.02"
            }
          ]
        },
        {
          "vendor": "Micro Focus",
          "product": "Network Automation",
          "versions": [
            {
              "status": "affected",
              "version": "10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-05-22T19:29:00.787",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/104131",
      "source": "security@opentext.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1040900",
      "source": "security@opentext.com"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03158014",
      "source": "security@opentext.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/104131",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1040900",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03158014",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be remotely exploited to allow Remote SQL Injection."
    },
    {
      "lang": "es",
      "value": "Inyección SQL en HP Network Operations Management Ultimate, versiones 2017.07, 2017.11 y 2018.02 y en Network Automation, versiones 10.00, 10.10, 10.11, 10.20, 10.30, 10.40 y 10.50. La vulnerabilidad se podría explotar de forma remota para permitir una inyección SQL remota."
    }
  ],
  "lastModified": "2026-06-17T02:01:54.570",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hp:network_operations_management_ultimate:2017.07:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A3F9593-C1BC-4B48-B007-4877EF49B725"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_operations_management_ultimate:2017.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56A77056-BBF3-4F8B-BEE1-231A61C40156"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_operations_management_ultimate:2018.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46DD1E7E-CA4A-4672-AC09-AFC639AC9EB7"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C74FE8A-030D-4C47-AE1F-2DC84C2D55BF"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6CA263E-3137-4B14-81B1-CA3DF5AAD845"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27A3AA40-2F05-4802-95A2-CCB57D9B1B62"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34BFE988-538A-40A9-BF9B-D36FA446C994"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A669FE08-E770-45CC-93ED-AD3901D5E218"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CC9AE65-24AF-43DB-81F6-BDF67B63F6A1"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.50:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B792109-3D86-4D93-9691-262DCE0F2B23"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}