CVE-2014-4858

Status: ModifiedHigh (7.5)—

Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.

CVSS

Version: 2.0
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Base score: 7.5

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.31%
Percentile among all scored CVEs: 70
Score date: 10/6/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (5)

Sabreairlinesolutions — Crew Management Sabreairlinesolutions — Crew Operations Sabreairlinesolutions — Crew Planning Sabreairlinesolutions — Crew Services Sabreairlinesolutions — Crew Training

CWEs

CWE-89

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2014-4858",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-07-26T11:11:57.457",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/394540",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/68899",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/394540",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/68899",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de inyección SQL en CWPLogin.aspx en los productos Sabre AirCentre Crew 2010.2.12.20008 y anteriores permiten a atacantes remotos ejecutar comandos SQL arbitrarios a través del campo (1) username o (2) password."
    }
  ],
  "lastModified": "2026-06-17T00:10:42.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sabreairlinesolutions:crew_management:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E19F7C38-5DB0-4CCA-8403-FFE371B8834B",
              "versionEndIncluding": "2010.2.12.20008"
            },
            {
              "criteria": "cpe:2.3:a:sabreairlinesolutions:crew_operations:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8B3E8AF-1266-4733-963E-0483E611F0D3",
              "versionEndIncluding": "2010.2.12.20008"
            },
            {
              "criteria": "cpe:2.3:a:sabreairlinesolutions:crew_planning:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C542871C-2B47-4B79-8921-25190C878176",
              "versionEndIncluding": "2010.2.12.20008"
            },
            {
              "criteria": "cpe:2.3:a:sabreairlinesolutions:crew_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FCABEDB-434C-4380-967F-3665E2FF17DD",
              "versionEndIncluding": "2010.2.12.20008"
            },
            {
              "criteria": "cpe:2.3:a:sabreairlinesolutions:crew_training:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69D7DD5B-F291-4D3C-A28E-B2E069573701",
              "versionEndIncluding": "2010.2.12.20008"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}