CVE-2021-40861

· HIGHModified

← All CVEs

CVSS v3.1

7.2

EPSS

1.68%

Published

Dec 8, 2021

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) 9.0.017.07 allows an attacker to execute arbitrary SQL queries via the value attribute, with which all data in the database can be extracted and OS command execution is possible depending on the permissions and/or database engine.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

Affected Products (1)

genesys · intelligent_workload_distribution_manager (up to 9.0.017.07)vulnerable

References (4)

https://docs.genesys.com/Documentation/IWD

ProductRelease NotesVendor Advisory

https://www.offensity.com/en/blog/authenticated-sql-injection-in-the-genesys-iwd-manager-cve-2021-40860-and-cve-2021-40861/

ExploitPatchThird Party Advisory

https://docs.genesys.com/Documentation/IWD

ProductRelease NotesVendor Advisory

https://www.offensity.com/en/blog/authenticated-sql-injection-in-the-genesys-iwd-manager-cve-2021-40860-and-cve-2021-40861/

ExploitPatchThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs