8.8
High
CVE-2023-37197 A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection')…
Description
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the mass configuration settings of endpoints on DCE.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| StruxureWare Data Center Expert | Versions not published | |
| struxureware_data_center_expert 7.9 | earliest → 7.9.3 | No fix stated |
Other CVEs of StruxureWare Data Center Expert
The 15 CVEs of StruxureWare Data Center Expert →
CVE-2023-37199
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code…
6.8
Medium
CVE-2023-37198
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code…
6.8
Medium
CVE-2023-37196
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection')…
8.8
High
CVE-2023-25555
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability…
5.6
Medium