CVE-2021-40861

2021-12-0814:58:13

mitre

www.cve.org

sql injection

genesys iwd

arbitrary sql queries

database extraction

os command execution

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

34.3%

JSON

A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) 9.0.017.07 allows an attacker to execute arbitrary SQL queries via the value attribute, with which all data in the database can be extracted and OS command execution is possible depending on the permissions and/or database engine.