CVE-2021-28969: SQL Injection
Published Apr 1, 2021
·Updated
eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sortby parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3. NOTE: this is different from CVE-2020-25034 and affects newer versions of the software.
Affected Software
2 affected components
FireEye Email Malware Protection System=9.0.1.923211
FireEye EX 3500
Event History
Apr 1, 2021
CVE Published
via MITRE·07:47 PM
Data Sourced
via MITRE·07:47 PM
Description
Frequently Asked Questions
1
What is CVE-2021-28969?
eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort_by parameter to the email search feature.
2
How severe is CVE-2021-28969?
The severity of CVE-2021-28969 is rated as medium with a CVSS score of 6.5.
3
What software versions are affected by CVE-2021-28969?
FireEye EX 3500 devices running eMPS 9.0.1.923211 are affected by CVE-2021-28969.
4
How can CVE-2021-28969 be fixed?
The issue is fixed in version 9.0.3 as provided by the vendor.