CVE-2020-15886

Name of the Vulnerable Software and Affected Versions MunkiReport versions prior to 3.5

Description A SQL injection issue in the reportdata module allows attackers to execute arbitrary SQL commands. This is achieved by manipulating the req parameter of the "/module/reportdata/ip" endpoint.

Recommendations For versions prior to 3.5, consider restricting access to the "/module/reportdata/ip" endpoint until a patch is available. As a temporary workaround, avoid using the req parameter in the affected endpoint to minimize the risk of exploitation. Update to version 3.5 or later to resolve the issue.