CVE-2014-9220

High

Published: 03/12/2014(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

CVE-2014-9220 describes an SQL injection vulnerability in OpenVAS Manager before version 4.0.6 and 5.x before version 5.0.7. It allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.

Risk Assessment

Attackers can exploit this vulnerability to gain access to the database, potentially leading to the disclosure of sensitive information or data modification. This poses a serious threat to the integrity and confidentiality of data within the organization.

Recommendation

It is recommended to upgrade OpenVAS Manager to version 4.0.6 or 5.0.7 to mitigate this vulnerability. Additionally, conducting a security audit of the application is advisable to minimize the risk of future attacks.

Other vulnerabilities in OpenVAS Manager

CVE-2013-6765High
OpenVAS Manager versions 3.0 before 3.0.7 and 4.0 before 4.0.4 allow remote attackers to bypass OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information.

Original NVD description (English source)

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.