Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by Emuse

    CVE-2021-36722 (GCVE-0-2021-36722)

    Vulnerability from cvelistv5 – Published: 2021-12-29 14:13 – Updated: 2024-09-16 18:38
    VLAI
    Title
    Emuse - eServices / eNvoice SQL injection
    Summary
    Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host.
    Severity
    7.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Emuse eServices / eNvoice Affected: Production
    		Create a notification for this product.
    Date Public
    2021-12-28 00:00
    Credits
    Simon Kenin - ClearSky Cyber Security Ltd.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:01:59.375Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/faq/cve_advisories"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "eServices / eNvoice",
          "vendor": "Emuse",
          "versions": [
            {
              "status": "affected",
              "version": "Production"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Simon Kenin - ClearSky Cyber Security Ltd."
        }
      ],
      "datePublic": "2021-12-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-29T14:13:38.000Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.gov.il/en/departments/faq/cve_advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The sql injection vulnerability was fixed by Escaping All User-Supplied Input"
        }
      ],
      "source": {
        "advisory": "ILVN-2021-0007",
        "defect": [
          "ILVN-2021-0007"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Emuse - eServices / eNvoice SQL injection",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@cyber.gov.il",
          "DATE_PUBLIC": "2021-12-28T11:43:00.000Z",
          "ID": "CVE-2021-36722",
          "STATE": "PUBLIC",
          "TITLE": "Emuse - eServices / eNvoice SQL injection"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "eServices / eNvoice",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "Production",
                            "version_value": "Production"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Emuse"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Simon Kenin - ClearSky Cyber Security Ltd."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.gov.il/en/departments/faq/cve_advisories",
              "refsource": "CONFIRM",
              "url": "https://www.gov.il/en/departments/faq/cve_advisories"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "The sql injection vulnerability was fixed by Escaping All User-Supplied Input"
          }
        ],
        "source": {
          "advisory": "ILVN-2021-0007",
          "defect": [
            "ILVN-2021-0007"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2021-36722",
    "datePublished": "2021-12-29T14:13:38.766Z",
    "dateReserved": "2021-07-12T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:38:48.510Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2021-36723 (GCVE-0-2021-36723)

    Vulnerability from cvelistv5 – Published: 2021-12-29 14:12 – Updated: 2024-09-16 17:18
    VLAI
    Title
    Emuse - eServices / eNvoice Exposure Of Private Personal Information
    Summary
    Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
    CWE
    • CWE-359 - Exposure of Private Information ('Privacy Violation')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Emuse eServices / eNvoice Affected: Production
    		Create a notification for this product.
    Date Public
    2021-12-28 00:00
    Credits
    Simon Kenin - ClearSky Cyber Security Ltd.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:01:59.421Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/faq/cve_advisories"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "eServices / eNvoice",
          "vendor": "Emuse",
          "versions": [
            {
              "status": "affected",
              "version": "Production"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Simon Kenin - ClearSky Cyber Security Ltd."
        }
      ],
      "datePublic": "2021-12-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-359",
              "description": "CWE-359 Exposure of Private Information (\u0027Privacy Violation\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-29T14:12:48.000Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.gov.il/en/departments/faq/cve_advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs vulnerability was fixed by adding securety mechanisms and randomising the IDs."
        }
      ],
      "source": {
        "advisory": "ILVN-2021-0008",
        "defect": [
          "ILVN-2021-0008"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Emuse - eServices / eNvoice Exposure Of Private Personal Information",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@cyber.gov.il",
          "DATE_PUBLIC": "2021-12-28T11:43:00.000Z",
          "ID": "CVE-2021-36723",
          "STATE": "PUBLIC",
          "TITLE": "Emuse - eServices / eNvoice Exposure Of Private Personal Information"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "eServices / eNvoice",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "Production",
                            "version_value": "Production"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Emuse"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Simon Kenin - ClearSky Cyber Security Ltd."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-359 Exposure of Private Information (\u0027Privacy Violation\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.gov.il/en/departments/faq/cve_advisories",
              "refsource": "CONFIRM",
              "url": "https://www.gov.il/en/departments/faq/cve_advisories"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "The Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs vulnerability was fixed by adding securety mechanisms and randomising the IDs."
          }
        ],
        "source": {
          "advisory": "ILVN-2021-0008",
          "defect": [
            "ILVN-2021-0008"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2021-36723",
    "datePublished": "2021-12-29T14:12:48.982Z",
    "dateReserved": "2021-07-12T00:00:00.000Z",
    "dateUpdated": "2024-09-16T17:18:07.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}