SQL Injection Vulnerability in Netentsec NS-ASG Application Security Gateway
CVE-2024-2022

9.8CRITICAL

Key Information:

Vendor

Netentsec

Status
Application Security Gateway
Vendor
CVE Published:
1 March 2024

What is CVE-2024-2022?

A vulnerability exists within the Netentsec NS-ASG Application Security Gateway version 6.3, specifically in the file /admin/list_ipAddressPolicy.php. This vulnerability allows an attacker to manipulate the GroupId argument, potentially leading to SQL injection attacks. Such attacks can be executed remotely, which poses significant risks to the security of sensitive data and the integrity of the affected systems. The exploit was publicly disclosed, indicating a pressing need for users to secure their environments against potential attacks. Despite efforts to inform the vendor about this issue, there was no response, highlighting the urgency for users to take immediate action to mitigate their exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://vuldb.com/?id.255301
https://vuldb.com/?ctiid.255301
https://github.com/zouzuo1994321/cve/blob/main/cve.md

EPSS Score

83% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.