Sign-up

ID

VAR-201909-0019


CVE

CVE-2019-4147


TITLE

IBM Sterling File Gateway In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-009398

DESCRIPTION

IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413. Vendors have confirmed this vulnerability IBM X-Force ID: 158413 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

Trust: 1.71

sources: NVD: CVE-2019-4147 // JVNDB: JVNDB-2019-009398 // VULHUB: VHN-155582

AFFECTED PRODUCTS

vendor:ibmmodel:sterling file gatewayscope:lteversion:6.0.1.0

Trust: 1.0

vendor:ibmmodel:sterling file gatewayscope:gteversion:2.2

Trust: 1.0

vendor:ibmmodel:sterling file gatewayscope:eqversion:2.2.0.0 to 6.0.1.0

Trust: 0.8

sources: JVNDB: JVNDB-2019-009398 // NVD: CVE-2019-4147

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-4147
value: HIGH

Trust: 1.0

psirt@us.ibm.com: CVE-2019-4147
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-4147
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201908-355
value: HIGH

Trust: 0.6

VULHUB: VHN-155582
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-4147
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-155582
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-4147
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

psirt@us.ibm.com: CVE-2019-4147
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 1.2
impactScore: 3.4
version: 3.0

Trust: 1.0

NVD: CVE-2019-4147
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-155582 // JVNDB: JVNDB-2019-009398 // CNNVD: CNNVD-201908-355 // NVD: CVE-2019-4147 // NVD: CVE-2019-4147

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.9

sources: VULHUB: VHN-155582 // JVNDB: JVNDB-2019-009398 // NVD: CVE-2019-4147

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201908-355

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-201908-355

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-009398

PATCH
title:888615url:https://www.ibm.com/support/pages/security-bulletin-sql-injection-vulnerability-affects-ibm-sterling-file-gateway-cve-2019-4147
Trust: 0.8
title:ibm-sterling-cve20194147-sql-injection (158413)url:https://exchange.xforce.ibmcloud.com/vulnerabilities/158413
Trust: 0.8
title:IBM Sterling File Gateway SQL Repair measures for injecting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=96111
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-009398 // 
            
            
            
            CNNVD: CNNVD-201908-355

EXTERNAL IDS
db:NVDid:CVE-2019-4147
Trust: 2.5
db:JVNDBid:JVNDB-2019-009398
Trust: 0.8
db:AUSCERTid:ESB-2019.2921
Trust: 0.6
db:CNNVDid:CNNVD-201908-355
Trust: 0.6
db:VULHUBid:VHN-155582
Trust: 0.1
sources:
            
            
            VULHUB: VHN-155582 // 
            
            
            
            JVNDB: JVNDB-2019-009398 // 
            
            
            
            CNNVD: CNNVD-201908-355 // 
            
            
            
            NVD: CVE-2019-4147

REFERENCES
url:https://www.ibm.com/support/pages/security-bulletin-sql-injection-vulnerability-affects-ibm-sterling-file-gateway-cve-2019-4147
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/158413
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-4147
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-4147
Trust: 0.8
url:https://www.ibm.com/support/docview.wss?uid=ibm10888615
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.2921/
Trust: 0.6
sources:
            
            
            VULHUB: VHN-155582 // 
            
            
            
            JVNDB: JVNDB-2019-009398 // 
            
            
            
            CNNVD: CNNVD-201908-355 // 
            
            
            
            NVD: CVE-2019-4147

SOURCES
db:VULHUBid:VHN-155582
db:JVNDBid:JVNDB-2019-009398
db:CNNVDid:CNNVD-201908-355
db:NVDid:CVE-2019-4147

LAST UPDATE DATE
2024-11-23T22:11:50.880000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-155582date:2022-12-09T00:00:00
db:JVNDBid:JVNDB-2019-009398date:2019-09-19T00:00:00
db:CNNVDid:CNNVD-201908-355date:2019-10-17T00:00:00
db:NVDid:CVE-2019-4147date:2024-11-21T04:43:14.187

SOURCES RELEASE DATE
db:VULHUBid:VHN-155582date:2019-09-16T00:00:00
db:JVNDBid:JVNDB-2019-009398date:2019-09-19T00:00:00
db:CNNVDid:CNNVD-201908-355date:2019-08-05T00:00:00
db:NVDid:CVE-2019-4147date:2019-09-16T19:15:10.523