CVE-2019-17117

HIGH

WiKID 2FA Enterprise Server through 4.2.0-b2053 - Authenticated SQL Injection via processPref.jsp Key Parameter

Title source: llm
STIX 2.1

Description

A SQL injection vulnerability in processPref.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows an authenticated user to execute arbitrary SQL commands via the processPref.jsp key parameter.

References (3)

Core 3
Core References
Exploit, Patch, Third Party Advisory x_refsource_misc
https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-sql-injection
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2019/Oct/35

Scores

CVSS v3 8.8
EPSS 0.0175
EPSS Percentile 75.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (10)
wikidsystems/2fa_enterprise_server 3.4.81 b676
wikidsystems/2fa_enterprise_server 3.4.85 b780
wikidsystems/2fa_enterprise_server 3.4.87 b1092 (6 CPE variants)
wikidsystems/2fa_enterprise_server 3.5.0 b1342 (12 CPE variants)
wikidsystems/2fa_enterprise_server 3.6.0 b1659 (2 CPE variants)
wikidsystems/2fa_enterprise_server 4.0 b1787 (3 CPE variants)
wikidsystems/2fa_enterprise_server 4.0.1 b1817 (4 CPE variants)
wikidsystems/2fa_enterprise_server 4.0.2 b1917 (2 CPE variants)
wikidsystems/2fa_enterprise_server 4.1.0 b1926 (4 CPE variants)
wikidsystems/2fa_enterprise_server 4.2.0 b1978 (12 CPE variants)
Published Oct 17, 2019
Tracked Since Feb 18, 2026