CVE-2017-6557

HIGH

ArrayOS < AG 9.4.0.135 - Authenticated SQL Injection via Portal Bookmark Function

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in ArrayOS before AG 9.4.0.135, when the portal bookmark function is enabled, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

References (1)

Core 1
Core References
Release Notes, Third Party Advisory x_refsource_confirm
https://github.com/amaciasf/array/blob/master/ArrayOS_AG_9_4_0_135_Release_Note.pdf

Scores

CVSS v3 8.8
EPSS 0.0106
EPSS Percentile 60.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
xirrus/arrayos
Published May 05, 2017
Tracked Since Feb 18, 2026