{"id":"CVE-2024-9968","state":"PUBLISHED","title":"NewType WebEIP v3.0 - SQL injection","description":"WebEIP v3.0 from \n\nNewType does not properly validate user input, allowing remote attackers with regular privilege to inject SQL commands to read, modify, and delete data stored in database. The affected product is no longer maintained. It is recommended to upgrade to the new product.","publishedAt":"2024-10-15T02:40:44.637Z","updatedAt":"2024-10-15T13:39:38.622Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"twcert"},"assigner":"twcert","products":["NewType WebEIP"],"affected":[{"vendor":"NewType","product":"WebEIP","defaultStatus":"unaffected","versions":[{"version":"3.0","status":"affected"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-8132-160bb-1.html","https://www.twcert.org.tw/en/cp-139-8133-2cc3a-2.html"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/9xxx/CVE-2024-9968.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-9968","state":"PUBLISHED","datePublished":"2024-10-15T02:40:44.637Z","dateUpdated":"2024-10-15T13:39:38.622Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2024-10-15T01:57:19.889Z"},"containers":{"cna":{"title":"NewType WebEIP v3.0 - SQL injection","descriptions":[{"lang":"en","value":"WebEIP v3.0 from \n\nNewType does not properly validate user input, allowing remote attackers with regular privilege to inject SQL commands to read, modify, and delete data stored in database. The affected product is no longer maintained. It is recommended to upgrade to the new product."}],"affected":[{"vendor":"NewType","product":"WebEIP","defaultStatus":"unaffected","versions":[{"version":"3.0","status":"affected"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-8132-160bb-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-8133-2cc3a-2.html","tags":["third-party-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2024-10-15T02:40:44.637Z"},"datePublic":"2024-10-15T02:37:00.000Z","impacts":[{"capecId":"CAPEC-66","descriptions":[{"lang":"en","value":"CAPEC-66 SQL Injection"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">The vendor has stated that WebEIP v3.0 has been released for over 15 years and is no longer supported or maintained. It is recommended to upgrade to the new WebEIP Pro product.</span>\n\n<br>"}],"value":"The vendor has stated that WebEIP v3.0 has been released for over 15 years and is no longer supported or maintained. It is recommended to upgrade to the new WebEIP Pro product."}],"source":{"advisory":"TVN-202410005","discovery":"EXTERNAL"},"tags":["unsupported-when-assigned"],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"new_type","product":"webeip","defaultStatus":"unknown","versions":[{"version":"3.0","status":"affected"}],"cpes":["cpe:2.3:a:new_type:webeip:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-15T13:37:47.090544Z","id":"CVE-2024-9968","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-15T13:39:38.622Z"}}]}}}