PT-2016-5356

CVE-2016-3072

تاريخ النشر

2016-06-07

تاريخ التحديث

2023-02-12

الوصف من

CVSS 3.1

8.8

عالية

المقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Katello (affected versions not specified)

Description The issue concerns multiple SQL injection vulnerabilities in the scoped search function. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands. The vulnerabilities can be exploited via the sort by or sort order parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

قابلية الاستغلال

استغلال

التأثيرات

الباحثون

Oliver

المورّدون

المنتجات المتأثرة

تصنيف نقاط الضعف

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

المعرّفات ذات الصلة

CVE-2016-3072