PT-2018-4027

CVE-2011-0467

Published

2018-06-07

Updated

2020-01-24

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SUSE Studio Onsite versions prior to 1.0.3-0.18.1 SUSE Studio Onsite 1.1 Appliance versions prior to 1.1.2-0.25.1

Description A vulnerability in SUSE Studio Onsite allows authenticated users to execute arbitrary SQL statements via SQL injection. This issue affects the listing of available software.

Recommendations For SUSE Studio Onsite versions prior to 1.0.3-0.18.1, update to version 1.0.3-0.18.1 or later. For SUSE Studio Onsite 1.1 Appliance versions prior to 1.1.2-0.25.1, update to version 1.1.2-0.25.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Matthias Weckbecker

Thomas Biege

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers