« Volver al listado

CVE-2009-3439

Estado: ModificadaMedia (6.5)—

Multiple SQL injection vulnerabilities in Open Source Security Information Management (OSSIM) before 2.1.2 allow remote authenticated users to execute arbitrary SQL commands via the id_document parameter to (1) repository_document.php, (2) repository_links.php, and (3) repository_editdocument.php in repository/; the (4) group parameter to policy/getpolicy.php; the name parameter to (5) host/newhostgroupform.php and (6) net/modifynetform.php; and unspecified other vectors related to the policy menu.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Alienvault — Ossim

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-3439",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-09-28T22:30:00.877",
  "references": [
    {
      "url": "http://dsecrg.com/pages/vul/show.php?id=155",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/36867",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/506663/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/36504",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://dsecrg.com/pages/vul/show.php?id=155",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/36867",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/506663/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/36504",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in Open Source Security Information Management (OSSIM) before 2.1.2 allow remote authenticated users to execute arbitrary SQL commands via the id_document parameter to (1) repository_document.php, (2) repository_links.php, and (3) repository_editdocument.php in repository/; the (4) group parameter to policy/getpolicy.php; the name parameter to (5) host/newhostgroupform.php and (6) net/modifynetform.php; and unspecified other vectors related to the policy menu."
    },
    {
      "lang": "es",
      "value": "Multiples vulnerabilidades de inyección SQL en Open Source Security Information Management (OSSIM) en versiones anteriores a la v2.1.2 permiten a usuarios remotos autenticados ejecutar comandos SQL de su elección a través de el parámetro \"id_document\" a (1) repository_document.php, (2) repository_links.php, y (3) repository_editdocument.php de repository/; el (4) parámetro \"group\" (grupo) a policy/getpolicy.php; el parámetro \"name\" (nombre) a (5) host/newhostgroupform.php y (6) net/modifynetform.php; y a través de otros vectores de ataque sin especificar relacionados con el menu \"policy\" (políticas)."
    }
  ],
  "lastModified": "2026-06-16T23:11:36.380",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:alienvault:ossim:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D331ECC2-2709-4A3E-ACDB-174CA343C082",
              "versionEndIncluding": "2.1"
            },
            {
              "criteria": "cpe:2.3:a:alienvault:ossim:1.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6078DC17-1842-4C1E-A550-6F00DCC8D246"
            },
            {
              "criteria": "cpe:2.3:a:alienvault:ossim:1.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "910427FD-DFC6-452F-8F8D-8235AD0036A5"
            },
            {
              "criteria": "cpe:2.3:a:alienvault:ossim:2.1:*:32bit:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5EBF296-9BF9-4D0A-A070-BCC085C90D6C"
            },
            {
              "criteria": "cpe:2.3:a:alienvault:ossim:2.1:*:64bit:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49206954-EFFF-4B98-9B13-D0F6ED897CF2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}