CVE-2019-18229: Advantech WISE-PaaS/RMM RecoveryMgmt fuzzySearch SQL Injection Information Disclosure Vulnerability
Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage these vulnerabilities to disclose information.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WISE-PasS/RMM. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DeviceMgmt class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of the Postgres database.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WISE-PasS/RMM. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the PowerMgmt class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of the Postgres database.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WISE-PasS/RMM. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ProtectionMgmt class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of the Postgres database.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WISE-PasS/RMM. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the RecoveryMgmt class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of the Postgres database.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WISE-PasS/RMM. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SQLMgmt class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of the Postgres database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-18229?
CVE-2019-18229 is rated as a medium severity vulnerability due to its potential for SQL injection.
How do I fix CVE-2019-18229?
To fix CVE-2019-18229, upgrade to a version of Advantech WISE-PaaS/RMM later than 3.3.29 that addresses this vulnerability.
What impact does CVE-2019-18229 have?
CVE-2019-18229 allows remote attackers to execute SQL injection, potentially leading to sensitive information disclosure.
Who is affected by CVE-2019-18229?
Any user of Advantech WISE-PaaS/RMM versions 3.3.29 and prior is affected by CVE-2019-18229.
Can CVE-2019-18229 be exploited remotely?
Yes, CVE-2019-18229 can be exploited remotely by attackers if the user-supplied input is not properly sanitized.