PT-2014-2212
CVE-2012-0939
·
تاريخ النشر
2014-08-14
·
تاريخ التحديث
2017-08-29
الوصف من
CVSS 2.0
6.5
متوسطةالمقاييسAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
TestLink versions 1.8.5b and earlier
Description
The issue allows remote authenticated users with the Requirement view permission to execute arbitrary SQL commands. This can be achieved via the
req spec id parameter to API endpoints such as "reqSpecAnalyse.php", "reqSpecPrint.php", or "reqSpecView.php" in the requirements/ directory.Recommendations
For TestLink versions 1.8.5b and earlier, as a temporary workaround, consider restricting access to the
req spec id parameter in the affected API endpoints until a patch is available. Avoid using the req spec id parameter in the "reqSpecAnalyse.php", "reqSpecPrint.php", or "reqSpecView.php" endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾