CVE-2016-1914: SQL Injection

Q: What is the severity of CVE-2016-1914?

CVE-2016-1914 has a medium severity rating due to the potential for remote SQL injection attacks.

Q: How do I fix CVE-2016-1914?

To fix CVE-2016-1914, update to BlackBerry Enterprise Server 12 version 12.4 or later.

Q: What systems are affected by CVE-2016-1914?

CVE-2016-1914 affects BlackBerry Enterprise Server 12 Self-Service versions prior to 12.4.

Q: What impact does CVE-2016-1914 have on my system?

CVE-2016-1914 allows remote attackers to execute arbitrary SQL commands, which can compromise database integrity.

Q: What is the vector for exploitation of CVE-2016-1914?

CVE-2016-1914 can be exploited by sending crafted requests with malicious SQL commands through the imageName parameter.

Published Apr 13, 2017

Updated

Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4 allow remote attackers to execute arbitrary SQL commands via the imageName parameter to (1) mydevice/client/image, (2) admin/client/image, (3) myapps/client/image, (4) ssam/client/image, or (5) all/client/image.

Affected Software

1 affected component

BlackBerry BlackBerry Enterprise Service<=12.3.1

Remediation

Patch Available

http://support.blackberry.com/kb/articleDetail?articleNumber=000038033

Event History

Apr 13, 2017

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-1914?

CVE-2016-1914 has a medium severity rating due to the potential for remote SQL injection attacks.

How do I fix CVE-2016-1914?