1. Home
  2. CVE Database
  3. CVE-2014-4858
HIGH · 7.5

CVE-2014-4858

Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2...

Vulnerability Description

Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.

CVSS Score

7.5

HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL

Affected Products

VendorProductVersions
SabreairlinesolutionsCrew Management<= 2010.2.12.20008
SabreairlinesolutionsCrew Operations<= 2010.2.12.20008
SabreairlinesolutionsCrew Planning<= 2010.2.12.20008
SabreairlinesolutionsCrew Services<= 2010.2.12.20008
SabreairlinesolutionsCrew Training<= 2010.2.12.20008

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2014-4858?

CVE-2014-4858 is a vulnerability with a CVSS score of 7.5 (HIGH). Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2...

How severe is CVE-2014-4858?

CVE-2014-4858 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-4858?

Check the references section above for vendor advisories and patch information. Affected products include: Sabreairlinesolutions Crew Management, Sabreairlinesolutions Crew Operations, Sabreairlinesolutions Crew Planning, Sabreairlinesolutions Crew Services, Sabreairlinesolutions Crew Training.