CVE-2016-8640

Опубликовано: 01 авг. 2018

Источник: nvd

CVSS3: 9.1

CVSS2: 7.5

EPSS Низкий

Описание

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.

Ссылки

http://seclists.org/oss-sec/2016/q4/406
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/94302
Third Party Advisory
VDB Entry
https://github.com/geopython/pycsw/pull/474/files
Patch
Third Party Advisory
https://patch-diff.githubusercontent.com/raw/geopython/pycsw/pull/474.patch
Patch
Third Party Advisory
http://seclists.org/oss-sec/2016/q4/406
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/94302
Third Party Advisory
VDB Entry
https://github.com/geopython/pycsw/pull/474/files
Patch
Third Party Advisory
https://patch-diff.githubusercontent.com/raw/geopython/pycsw/pull/474.patch
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:pycsw:pycsw:*:*:*:*:*:*:*:*

Версия до 1.8.6 (исключая)

cpe:2.3:a:pycsw:pycsw:*:*:*:*:*:*:*:*

Версия от 1.10.0 (включая) до 1.10.5 (исключая)

cpe:2.3:a:pycsw:pycsw:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.0.2 (исключая)

EPSS

Процентиль: 75%

0.00905

Низкий

9.1 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

CVE-2016-8640

CVSS3: 9.1

ubuntu

больше 7 лет назад

CVE-2016-8640

CVSS3: 9.1

debian

больше 7 лет назад

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10 ...

GHSA-hg4c-rgvm-964g

CVSS3: 9.1

github

больше 7 лет назад

SQL Injection in pycsw

EPSS

Процентиль: 75%

0.00905

Низкий

9.1 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89