PT-2016-5356

CVE-2016-3072

Published

2016-06-07

Updated

2023-02-12

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Katello (affected versions not specified)

Description The issue concerns multiple SQL injection vulnerabilities in the scoped search function. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands. The vulnerabilities can be exploited via the sort by or sort order parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Oliver

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2016-3072