CVE-2019-11363: SQL Injection
First published: Thu Aug 29 2019(Updated: )
A SQL injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to execute arbitrary SQL commands via the AgentConsole/UserGroupQuery.php ShowUser parameter.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Prophecyinternational Snare Central | <7.4.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-11363?
CVE-2019-11363 is a SQL injection vulnerability in Snare Central before version 7.4.5.
How does CVE-2019-11363 allow remote attackers to execute arbitrary SQL commands?
CVE-2019-11363 allows remote authenticated attackers to execute arbitrary SQL commands via the ShowUser parameter in AgentConsole/UserGroupQuery.php.
What is the severity rating of CVE-2019-11363?
CVE-2019-11363 has a severity rating of 7.2 (high).
Which versions of Snare Central are affected by CVE-2019-11363?
Snare Central versions up to and excluding 7.4.5 are affected by CVE-2019-11363.
How can I fix CVE-2019-11363?
To fix CVE-2019-11363, update Snare Central to version 7.4.5 or higher.
- collector/nvd-index
- vendor/prophecyinternational
- canonical/prophecyinternational snare central