CVE-2014-3719
Summary
| CVE | CVE-2014-3719 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-01-30 20:15:00 UTC |
| Updated | 2020-02-05 14:26:00 UTC |
| Description | Multiple SQL injection vulnerabilities in cgi-bin/review_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 allow remote attackers to execute arbitrary SQL commands via the (1) find, (2) lib, or (3) sid parameter. |
Risk And Classification
Problem Types: CWE-89
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Exlibrisgroup | Aleph 500 | 18.1 | All | All | All |
| Application | Exlibrisgroup | Aleph 500 | 20.0 | All | All | All |
| Application | Exlibrisgroup | Aleph 500 | 18.1 | All | All | All |
| Application | Exlibrisgroup | Aleph 500 | 20.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Aleph 500 SQL Injection ≈ Packet Storm | MISC | packetstormsecurity.com | Exploit, Third Party Advisory, VDB Entry |
| Full Disclosure: [CVE-2014-3719] ALEPH500 (Integrated library management system) SQL Injection | MISC | seclists.org | Mailing List, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.