Details of VAR-201302-0005

ID

VAR-201302-0005

CVE

CVE-2011-5262

TITLE

SonicWALL Aventail In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2013-001562

DESCRIPTION

SQL injection vulnerability in prodpage.cfm in SonicWALL Aventail allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter. SonicWALL Aventail is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. Further research conducted by the vendor indicates this issue may not be a vulnerability affecting the application. SonicWALL is a full-featured Internet security appliance designed specifically for large networks with ever-growing VPN needs

Trust: 1.98

sources: NVD: CVE-2011-5262 // JVNDB: JVNDB-2013-001562 // BID: 50702 // VULHUB: VHN-53207

AFFECTED PRODUCTS

vendor:	sonicwall	model:	aventail sra ex9000	scope:	eq	version:	-	Trust: 1.6
vendor:	sonicwall	model:	aventail sra ex7000	scope:	eq	version:	-	Trust: 1.6
vendor:	sonicwall	model:	aventail sra ex virtual appliance	scope:	eq	version:	-	Trust: 1.6
vendor:	sonicwall	model:	aventail sra ex6000	scope:	eq	version:	-	Trust: 1.6
vendor:	sonicwall	model:	aventail sra ex virtual appliance	scope:	-	version:	-	Trust: 0.8
vendor:	sonicwall	model:	aventail sra ex6000	scope:	-	version:	-	Trust: 0.8
vendor:	sonicwall	model:	aventail sra ex7000	scope:	-	version:	-	Trust: 0.8
vendor:	sonicwall	model:	aventail sra ex9000	scope:	-	version:	-	Trust: 0.8
vendor:	sonicwall	model:	aventail	scope:	eq	version:	0	Trust: 0.3

sources: BID: 50702 // JVNDB: JVNDB-2013-001562 // CNNVD: CNNVD-201111-323 // NVD: CVE-2011-5262

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2011-5262
value:	HIGH
Trust: 1.0
NVD:	CVE-2011-5262
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201111-323
value:	HIGH
Trust: 0.6
VULHUB:	VHN-53207
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2011-5262
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-53207
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-53207 // JVNDB: JVNDB-2013-001562 // CNNVD: CNNVD-201111-323 // NVD: CVE-2011-5262

PROBLEMTYPE DATA

problemtype:

CWE-89

Trust: 1.9

sources: VULHUB: VHN-53207 // JVNDB: JVNDB-2013-001562 // NVD: CVE-2011-5262

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201111-323

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-201111-323

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-001562

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-53207

PATCH

title:

SonicWALL Aventail

url:

http://www.sonicwall.com/us/en/products/EX_Series.html

Trust: 0.8

sources: JVNDB: JVNDB-2013-001562

EXTERNAL IDS

db:	NVD	id:	CVE-2011-5262	Trust: 2.8
db:	BID	id:	50702	Trust: 2.0
db:	OSVDB	id:	77484	Trust: 1.7
db:	EXPLOIT-DB	id:	18122	Trust: 1.7
db:	JVNDB	id:	JVNDB-2013-001562	Trust: 0.8
db:	CNNVD	id:	CNNVD-201111-323	Trust: 0.7
db:	SEEBUG	id:	SSVID-72337	Trust: 0.1
db:	VULHUB	id:	VHN-53207	Trust: 0.1

sources: VULHUB: VHN-53207 // BID: 50702 // JVNDB: JVNDB-2013-001562 // CNNVD: CNNVD-201111-323 // NVD: CVE-2011-5262

REFERENCES

url:	http://www.securityfocus.com/bid/50702	Trust: 1.7
url:	http://www.exploit-db.com/exploits/18122	Trust: 1.7
url:	http://www.osvdb.org/77484	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-5262	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-5262	Trust: 0.8
url:	http://www.sonicwall.com/us/products/ex_series.html	Trust: 0.3

sources: VULHUB: VHN-53207 // BID: 50702 // JVNDB: JVNDB-2013-001562 // CNNVD: CNNVD-201111-323 // NVD: CVE-2011-5262

CREDITS

Asheesh Anaconda

Trust: 0.9

sources: BID: 50702 // CNNVD: CNNVD-201111-323

SOURCES

db:	VULHUB	id:	VHN-53207
db:	BID	id:	50702
db:	JVNDB	id:	JVNDB-2013-001562
db:	CNNVD	id:	CNNVD-201111-323
db:	NVD	id:	CVE-2011-5262

LAST UPDATE DATE

2024-08-14T15:24:50.400000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-53207	date:	2013-02-13T00:00:00
db:	BID	id:	50702	date:	2013-02-14T12:21:00
db:	JVNDB	id:	JVNDB-2013-001562	date:	2013-02-15T00:00:00
db:	CNNVD	id:	CNNVD-201111-323	date:	2013-02-17T00:00:00
db:	NVD	id:	CVE-2011-5262	date:	2013-02-13T05:00:00

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-53207	date:	2013-02-12T00:00:00
db:	BID	id:	50702	date:	2011-11-17T00:00:00
db:	JVNDB	id:	JVNDB-2013-001562	date:	2013-02-15T00:00:00
db:	CNNVD	id:	CNNVD-201111-323	date:	1900-01-01T00:00:00
db:	NVD	id:	CVE-2011-5262	date:	2013-02-12T20:55:03.777