Multiple vulnerabilities in CA Workload Automation AE and CA Workload Control Center
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2018-8953 CVE-2018-8954 |
| CWE-ID | CWE-89 CWE-264 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
CA Workload Automation Client/Desktop applications / Office applications CA Workload Control Center Client/Desktop applications / Office applications |
| Vendor | CA Technologies |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) SQL injection
EUVDB-ID: #VU11457
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-8953
CWE-ID:
CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to execute arbitrary SQL commands in web application database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in web application database.
Successful exploitation of the vulnerability may allow an attacker to gain administrative access to vulnerable web application.
MitigationUpdate to version 11.3.6 SP7.
Vulnerable software versionsCA Workload Automation: 11.3.5 - 11.3.6 SP6
CPE2.3- cpe:2.3:a:ca_technologies:ca_workload_automation:11.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:ca_technologies:ca_workload_automation:11.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:ca_technologies:ca_workload_automation:11.3.6 SP1:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Remote code execution
EUVDB-ID: #VU11459
Risk: High
CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2018-8954
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.
The vulnerability exists due to a flaw in Apache MyFaces component. A remote attacker can execute arbitrary code with elevated privileges.
Update to version 11.4 SP6.
Vulnerable software versionsCA Workload Control Center: 11.4 - 11.4 SP5
CPE2.3- cpe:2.3:a:ca_technologies:ca_workload_control_center:11.4:*:*:*:*:*:*:*
- cpe:2.3:a:ca_technologies:ca_workload_control_center:11.4 SP1:*:*:*:*:*:*:*
- cpe:2.3:a:ca_technologies:ca_workload_control_center:11.4 SP2:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
