What’s Vulnerable › Vulnerabilities

CVE-2014-4858

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-07-26 · updated 2026-06-17
• Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.

Affected products

• Sabreairlinesolutions Crew Management: through 2010.2.12.20008
• Sabreairlinesolutions Crew Operations: through 2010.2.12.20008
• Sabreairlinesolutions Crew Planning: through 2010.2.12.20008
• Sabreairlinesolutions Crew Services: through 2010.2.12.20008
• Sabreairlinesolutions Crew Training: through 2010.2.12.20008

References

• http://www.kb.cert.org/vuls/id/394540
• http://www.securityfocus.com/bid/68899
• http://www.kb.cert.org/vuls/id/394540
• http://www.securityfocus.com/bid/68899

Get alerted when CVE-2014-4858 or the next vulnerability affects your stack