CVE-2019-11600

Опубликовано: 13 мая 2019

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Высокий

Описание

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.

Ссылки

http://packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/May/7
Exploit
Mailing List
Third Party Advisory
https://groups.google.com/forum/#%21msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ
https://seclists.org/bugtraq/2019/May/22
Exploit
Issue Tracking
Mailing List
Third Party Advisory
https://www.openproject.org/release-notes/openproject-8-3-2/
Vendor Advisory
http://packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/May/7
Exploit
Mailing List
Third Party Advisory
https://groups.google.com/forum/#%21msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ
https://seclists.org/bugtraq/2019/May/22
Exploit
Issue Tracking
Mailing List
Third Party Advisory
https://www.openproject.org/release-notes/openproject-8-3-2/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 8.3.2 (исключая)

EPSS

Процентиль: 99%

0.80674

Высокий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-c233-43hc-2x3j