title: MXsecurity Authenticated Information Disclosure Due to SQL Injection
description: A vulnerability that allows the unauthorized disclosure of authenticated information has been identified in MXsecurity versions prior to v1.0.1. This vulnerability arises when special elements are not neutralized correctly, allowing remote attackers to alter SQL commands.
problem types: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
defaultStatus: unaffected
product: MXsecurity Series
vendor: Moxa
versions:
lessThanOrEqual: 1.0.1, status: affected, version: 1.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Moxa has developed appropriate solution to address the vulnerability. The solution for affected product is shown below.
*  MXsecurity: Please upgrade to software v1.1.0 or higher.