« Volver al listado

CVE-2019-15016

Estado: ModificadaAlta (8.8)—

An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zingbox — Inspector

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-15016",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@paloaltonetworks.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Palo Alto Networks Zingbox Inspector",
          "versions": [
            {
              "status": "affected",
              "version": "Zingbox Inspector, versions 1.288 and earlier."
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-10-09T21:15:12.757",
  "references": [
    {
      "url": "https://security.paloaltonetworks.com/CVE-2019-15016",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "https://security.paloaltonetworks.com/CVE-2019-15016",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de inyección SQL en la interfaz de administración de Zingbox Inspector versiones 1.288 y anteriores, lo que permite que los datos no saneados provistos por un usuario autenticado sean pasados desde la interfaz de usuario web hacia la base de datos."
    }
  ],
  "lastModified": "2026-06-17T02:19:30.840",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zingbox:inspector:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF07FEC8-C4B9-4558-B034-21C5B31547A0",
              "versionEndIncluding": "1.288"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com"
}