« Volver al listado

CVE-2019-11057

Estado: ModificadaAlta (8.8)—

SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vtiger — Vtiger CRM

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-11057",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-05-17T17:29:00.280",
  "references": [
    {
      "url": "http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-April/037964.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://cybersecurityworks.com/zerodays/cve-2019-11057-vtiger.html",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://medium.com/%40mohnishdhage/sql-injection-vtiger-crm-v7-1-0-cve-2019-11057-245f84fc5c2c",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-April/037964.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://cybersecurityworks.com/zerodays/cve-2019-11057-vtiger.html",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://medium.com/%40mohnishdhage/sql-injection-vtiger-crm-v7-1-0-cve-2019-11057-245f84fc5c2c",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de la inyección de SQL en Vtiger CRM antes de la revisión 7.1.03 permite a los usuarios autenticados ejecutar comandos SQL arbitrarios."
    }
  ],
  "lastModified": "2026-06-17T02:12:13.390",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3EEF382-AB9D-45C3-9B1B-95F67556707C",
              "versionEndIncluding": "7.0.1"
            },
            {
              "criteria": "cpe:2.3:a:vtiger:vtiger_crm:7.1.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A513046B-B65A-4662-B0E4-AAF11E6351F6"
            },
            {
              "criteria": "cpe:2.3:a:vtiger:vtiger_crm:7.1.0:hotfix1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EBD043D-53C6-4C4C-9D17-0CE7BEC3541C"
            },
            {
              "criteria": "cpe:2.3:a:vtiger:vtiger_crm:7.1.0:hotfix2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D4311D3-4C53-4238-A37B-16F09959011B"
            },
            {
              "criteria": "cpe:2.3:a:vtiger:vtiger_crm:7.1.0:rc:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1BC8698-9AA0-411D-9F8F-3A6346E3BDF3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}