Описание
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | code not present |
| esm-apps-legacy/xenial | released | 1:0.37+20120626-1ubuntu0.1~esm1 |
| esm-apps/bionic | released | 1:0.38+20170615-1ubuntu0.1~esm1 |
| esm-apps/focal | released | 1:0.40-2ubuntu0.1~esm1 |
| esm-apps/jammy | released | 1:0.61-1ubuntu0.1~esm1 |
| esm-apps/noble | released | 1:0.62-4ubuntu0.1~esm1 |
| esm-apps/resolute | not-affected | code not present |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| focal | ignored | end of standard support, was needs-triage |
| jammy | needed |
Показывать по
EPSS
6.5 Medium
CVSS2
6.3 Medium
CVSS3
Связанные уязвимости
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as critical, was found in webpy ...
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Уязвимость функции PostgresDB._process_insert_query() (file web/db.py) веб-фреймворка создания веб-приложений web.py, позволяющая нарушителю выполнить произвольные SQL-команды
EPSS
6.5 Medium
CVSS2
6.3 Medium
CVSS3