« Volver al listado

CVE-2019-15301

Estado: ModificadaCrítica (9.8)—

Una vulnerabilidad de inyección SQL en el método Terrasoft.Core.DB.Column.Const() en Terrasoft Bpm'online CRM-System SDK versión 7.13, permite a atacantes ejecutar comandos SQL arbitrarios por medio del parámetro value.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Terrasoft — BPM Online CRM System SDK

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-15301",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-09-18T21:15:13.077",
  "references": [
    {
      "url": "https://medium.com/%40sorokinpf/bpmonline-sql-injection-607916447e30",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://medium.com/%40sorokinpf/bpmonline-sql-injection-607916447e30",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A SQL injection vulnerability in the method Terrasoft.Core.DB.Column.Const() in Terrasoft Bpm'online CRM-System SDK 7.13 allows attackers to execute arbitrary SQL commands via the value parameter."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL en el método Terrasoft.Core.DB.Column.Const() en Terrasoft Bpm'online CRM-System SDK versión 7.13, permite a atacantes ejecutar comandos SQL arbitrarios por medio del parámetro value."
    }
  ],
  "lastModified": "2026-06-17T02:20:03.640",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:terrasoft:bpm_online_crm_system_sdk:7.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCB660E3-D7BC-4BA0-A73F-3933608C4AB7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}