« Volver al listado

CVE-2015-7299

Estado: ModificadaAlta (7.5)—

SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrary SQL commands via the xml parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Nintex — K2 BlackpearlNintex — K2 FOR SharepointNintex — K2 Smartforms

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-7299",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-10-21T18:59:05.223",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/133953/K2-SmartForms-BlackPearl-SQL-Injection.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/536673/100/0/threaded",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/133953/K2-SmartForms-BlackPearl-SQL-Injection.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/536673/100/0/threaded",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrary SQL commands via the xml parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección SQL en Runtime/Runtime/AjaxCall.ashx en K2 blackpearl, smartforms y K2 para SharePoint 4.6.7 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro xml."
    }
  ],
  "lastModified": "2026-06-17T00:32:13.160",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nintex:k2_blackpearl:4.6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88A60B19-4BC8-4EC3-9E56-3F5797FEEB4F"
            },
            {
              "criteria": "cpe:2.3:a:nintex:k2_for_sharepoint:4.6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "814F576E-9D88-49E0-B110-8B7CB7C38E7A"
            },
            {
              "criteria": "cpe:2.3:a:nintex:k2_smartforms:4.6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C75A85AA-BB2B-41F4-99ED-D705B13A68B5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}