CVE-2020-6114 MEDIUM

CVE-2020-6114

Vendor N/A
Product Glacies IceHRM"
Weakness CWE-89 · SQLi
Published July 10, 2020
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

6.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Key dates

02Disclosure timeline

July 10, 2020 CVE published
August 4, 2024 Record updated