CVE-2018-15904

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-15904
A10 ACOS Web Application Firewall (WAF) 2.7.1 and 2.7.2 before 2.7.2-P12, 4.1.0 before 4.1.0-P11, 4.1.1 before 4.1.1-P8, and 4.1.2 before 4.1.2-P4 mishandles the configured rules for blocking SQL injection attacks, aka A10-2017-0008.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://www.a10networks.com/support/security-advisories/waf-sql-injection-attack-sqlia-vulnerability Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.1:*:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:*:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p1:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p10:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p11:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p2:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p3:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p4:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p5:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p6:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p7:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p7-sp3:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p8:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p9:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p1:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p10:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p2:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p3:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p4:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p5:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p6:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p7:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p8:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p9:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:*:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p1:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p2:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p3:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p4:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p5:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p6:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p7:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:*:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:p1:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:p2:*:*:*:*:*:*
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:p3:*:*:*:*:*:*
History

No history.

Information

Published : 2018-08-27 15:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-15904

Mitre link : CVE-2018-15904

CVE.ORG link : CVE-2018-15904

JSON object : View

Products Affected

a10networks

  • acos_web_application_firewall
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')