CVE-2018-8802

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-03-26 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters.

Affected products

Unisys Clearpath Eportal Manager: before 17.0a.31; before 059.1a.13 — fixed in 059.1a.13, 17.0a.31
Unisys Eportal-2200: before 2.2.81; before 2.3.82 — fixed in 2.2.81, 2.3.82

How to fix

Upgrade to a fixed version: Unisys Clearpath Eportal Manager 059.1a.13, 17.0a.31; Unisys Eportal-2200 2.2.81, 2.3.82. Check the vendor advisory for mitigations.

References

https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=49
https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=49

Get alerted when CVE-2018-8802 or the next vulnerability affects your stack