SQL Injection in Zingbox Inspector

CVE-2019-15016

An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database.

Vulnerability class: SQL Injection

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.012 (65.9th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 65.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2019-15016: held from 0.012 to 0.012.

EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000

Affected products

  • Zingbox Inspector
  • Palo Alto Networks Zingbox Inspector — versions Zingbox Inspector, versions 1.288 and earlier.

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2019-15016?
CVE-2019-15016 is a high-severity vulnerability in Zingbox Inspector, classified under SQL Injection. CVSS score: 8.8/10. Published 2019-10-09.
How severe is CVE-2019-15016?
High severity. CVSS v3 base score is 8.8 out of 10.