CVE-2021-41063: SQL Injection

Reference Links

• https://www.cisa.gov/uscert/ics/advisories/icsa-21-334-01
• https://www.xylem.com
• https://www.xylem.com/en-us/about-xylem/cybersecurity/advisories/
• https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-aanderaa-psa-2021-003.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-21-334-01 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• ICSA-21-334-01

Frequently Asked Questions

• What is the severity of CVE-2021-41063?

  CVE-2021-41063 is considered a high-severity SQL injection vulnerability that can allow unauthenticated attackers to execute arbitrary commands.

• How do I fix CVE-2021-41063?

  To fix CVE-2021-41063, upgrade Aanderaa GeoView Webservice to version 2.1.3 or later.

• What type of attack does CVE-2021-41063 facilitate?

  CVE-2021-41063 facilitates SQL injection attacks, which can lead to unauthorized data access and command execution.

• Who is affected by CVE-2021-41063?

  Users of Aanderaa GeoView Webservice versions prior to 2.1.3 are affected by CVE-2021-41063.

• Is authentication required to exploit CVE-2021-41063?

  No, CVE-2021-41063 can be exploited by unauthenticated attackers, making it particularly dangerous.