Critical severity · published Apr 25, 2019
CVE-2018-18286
SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for…
9.8
CVSS
1.8%
EPSS
No
On KEV
Description
SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the changepwd interface. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cmg Suite · Mitel
through 8.4; 8.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-18286
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-18286
Vendor Advisory
https://www.mitel.com/-/media/mitel/pdf/security-advisories/security-bulletin-19-0003-001.pdf
Vendor Advisory
https://www.mitel.com/en-gb/support/security-advisories/mitel-product-security-adivsory-19-0003-001
More from Cmg Suite
9.8
CVE-2018-18285
SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for…
9.8
CVE-2018-19275
The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain unauthorized access…