CVE-2017-3221

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwords.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Inmarsat	AmosConnect	8.0, 8.0.1, 8.0.2, 8.2.0, 8.2.1, 8.2.2, 8.3.0, 8.3.1, 8.4.0, 8.4.0.1

References

http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/
http://www.securityfocus.com/bid/99899Third Party Advisory, VDB Entry
https://twitter.com/mkolsek/status/923988845783322625
https://www.kb.cert.org/vuls/id/586501Third Party Advisory, US Government Resource
http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/
http://www.securityfocus.com/bid/99899Third Party Advisory, VDB Entry
https://twitter.com/mkolsek/status/923988845783322625
https://www.kb.cert.org/vuls/id/586501Third Party Advisory, US Government Resource

Timeline

Published: Jul 22, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-32229.8Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute comm CVE-2017-32239.8Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be CVE-2017-32248.2Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSe CVE-2017-32254.6Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encrypt CVE-2017-32266.4Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Devices that make use of Das U-Boot's AES-CBC CVE-2017-32308.6Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). Supported version CVE-2017-32314.3Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected CVE-2017-32325.5Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version th CVE-2017-32337.5Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version th CVE-2017-32349.8Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version th CVE-2017-32353.5Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported v CVE-2017-32364.7Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported v