CVE-2020-36768

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-36768
A vulnerability was found in rl-institut NESP2 Initial Release/1.0. It has been classified as critical. Affected is an unknown function of the file app/database.py. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 07c0cdf36cf6a4345086d07b54423723a496af5e. It is recommended to apply a patch to fix this issue. VDB-246642 is the identifier assigned to this vulnerability.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://vuldb.com/?id.246642 Permissions Required Third Party Advisory
https://vuldb.com/?ctiid.246642 Permissions Required Third Party Advisory
https://github.com/rl-institut/NESP2/pull/333 Issue Tracking Patch
https://github.com/rl-institut/NESP2/issues/334 Issue Tracking Patch
https://github.com/rl-institut/NESP2/commit/07c0cdf36cf6a4345086d07b54423723a496af5e Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:reiner-lemoine-institut:nesp2:1.0:*:*:*:*:*:*:*
History

07 Dec 2023, 02:14

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References () https://github.com/rl-institut/NESP2/commit/07c0cdf36cf6a4345086d07b54423723a496af5e - () https://github.com/rl-institut/NESP2/commit/07c0cdf36cf6a4345086d07b54423723a496af5e - Patch
References () https://github.com/rl-institut/NESP2/pull/333 - () https://github.com/rl-institut/NESP2/pull/333 - Issue Tracking, Patch
References () https://vuldb.com/?id.246642 - () https://vuldb.com/?id.246642 - Permissions Required, Third Party Advisory
References () https://github.com/rl-institut/NESP2/issues/334 - () https://github.com/rl-institut/NESP2/issues/334 - Issue Tracking, Patch
References () https://vuldb.com/?ctiid.246642 - () https://vuldb.com/?ctiid.246642 - Permissions Required, Third Party Advisory
First Time Reiner-lemoine-institut nesp2
Reiner-lemoine-institut
CPE cpe:2.3:a:reiner-lemoine-institut:nesp2:1.0:*:*:*:*:*:*:*

03 Dec 2023, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-03 11:15

Updated : 2024-05-17 01:48

NVD link : CVE-2020-36768

Mitre link : CVE-2020-36768

JSON object : View

Products Affected

reiner-lemoine-institut

  • nesp2
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')