CVE-2024-52335 CRITICAL

CVE-2024-52335

Vendor Siemens
Product syngo.plaza VB30E
Weakness CWE-89 · SQLi
Published December 6, 2024
Last update December 6, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

What the vulnerability does

01Description

A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF05). The affected application do not properly sanitize input data before sending it to the SQL server. This could allow an attacker with access to the application could use this vulnerability to execute malicious SQL commands to compromise the whole database.

Key dates

02Disclosure timeline

December 6, 2024 CVE published
December 6, 2024 Record updated