ZDI-20-1208: Hewlett Packard Enterprise Universal API Framework uaf_token SQL Injection Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Hewlett Packard Enterprise Universal API Framework. Authentication is not required to exploit this vulnerability. The specific flaw exists within the connections resource. A crafted uaf-token header can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-20-1208?
The severity of ZDI-20-1208 is considered to be high due to its potential for sensitive information disclosure.
How do I fix ZDI-20-1208?
To fix ZDI-20-1208, apply the latest security patches provided by Hewlett Packard Enterprise for the Universal API Framework.
Who is affected by ZDI-20-1208?
ZDI-20-1208 affects any installations of Hewlett Packard Enterprise Universal API Framework that have not been updated.
Can ZDI-20-1208 be exploited remotely?
Yes, ZDI-20-1208 can be exploited by network-adjacent attackers without requiring authentication.
What kind of information can be disclosed by ZDI-20-1208?
ZDI-20-1208 allows unauthorized access to sensitive information that could be leveraged for further attacks.