CVE-2024-9134— Arista NG Firewall 安全漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2024-9134の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
ソース: NVD (National Vulnerability Database)
脆弱性説明
Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Arista NG Firewall 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Arista NG Firewall是美国Arista公司的一款 WEB 防火墙。 Arista NG Firewall存在安全漏洞，该漏洞源于应用程序中存在多个 SQL 注入漏洞。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Arista Networks | Arista Edge Threat Management | 17.1.0 ~ 17.1.1 | - |
II. CVE-2024-9134の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2024-9134のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · Arista Networks · 2025-01-10 · 13 CVEs total
| CVE-2024-9188 | 8.8 HIGH | Specially constructed queries cause cross platform scripting leaking administrator tokens |
| CVE-2024-47519 | 8.3 HIGH | Backup uploads to ETM subject to man-in-the-middle interception |
| CVE-2024-9132 | 8.1 HIGH | The administrator is able to configure an insecure captive portal script |
| CVE-2024-47520 | 7.6 HIGH | A user with advanced report application access rights can perform actions for which they a |
| CVE-2024-9131 | 7.2 HIGH | A user with administrator privileges can perform command injection |
| CVE-2024-47517 | 6.8 MEDIUM | Expired and unusable administrator authentication tokens can be revealed by units that hav |
| CVE-2024-9133 | 6.6 MEDIUM | A user with administrator privileges is able to retrieve authentication tokens |
| CVE-2024-5872 | 6.5 MEDIUM | On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN t |
| CVE-2024-47518 | 6.4 MEDIUM | Specially constructed queries targeting ETM could discover active remote access sessions |
| CVE-2024-6437 | 5.8 MEDIUM | On affected platforms running Arista EOS with one of the following features configured to |
| CVE-2024-7142 | 4.6 MEDIUM | On Arista CloudVision Appliance (CVA) affected releases running on appliances that support |
| CVE-2024-7095 | 4.3 MEDIUM | On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit ma |
IV. 関連脆弱性
- CVE-2024-9188
Specially constructed queries cause cross platform scripting - CVE-2024-47520
A user with advanced report application access rights can pe - CVE-2024-47519
Backup uploads to ETM subject to man-in-the-middle intercept - CVE-2024-47518
Specially constructed queries targeting ETM could discover a - CVE-2024-47517
Expired and unusable administrator authentication tokens can
同じベンダー: Arista Networks
- CVE-2025-7048
On affected platforms running Arista EOS with MACsec configu - CVE-2025-8872
A specially crafted packet can cause the OSFPv3 process to h - CVE-2025-8870
On affected platforms running Arista EOS, certain serial con - CVE-2025-54549
Cryptographic validation of upgrade images could be circumve - CVE-2025-54548
On affected platforms, restricted users could view sensitive
同じ弱点: CWE-89
- CVE-2021-47941
WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss - CVE-2021-47930
Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthentic - CVE-2021-47928
Opencart TMD Vendor System 3.x Blind SQL Injection via produ - CVE-2026-8231
CodeAstro Online Catering Ordering System deleteorder.php sq - CVE-2025-14179
SQL injection in pdo_firebird via NUL bytes in quoted string
V. CVE-2024-9134へのコメント
まだコメントはありません