SQL Injection Vulnerability in IBM Engineering Lifecycle Optimization Product
CVE-2021-39018

4.3MEDIUM

Key Information:

Vendor
IBM
Status
Engineering Lifecycle Optimization Publishing
Vendor
CVE Published:
14 July 2022

Summary

IBM Engineering Lifecycle Optimization - Publishing versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 are susceptible to a SQL injection vulnerability that can potentially expose sensitive information through error messages generated by SQL queries. This exposure could provide attackers with critical insights that facilitate further exploitation of the system. Organizations using these affected versions should urgently review and apply the necessary updates to mitigate the risk.

Affected Version(s)

Engineering Lifecycle Optimization Publishing 6.0.6

Engineering Lifecycle Optimization Publishing 6.0.6.1

Engineering Lifecycle Optimization Publishing 7.0

References

https://www.ibm.com/support/pages/node/6603345
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/213726
vdb-entryx_refsource_XF

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.