PT-2023-25666 · Unknown · Openitcockpit
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
openITCOCKPIT versions 4.6.4 through 4.6.4
Description
The issue allows SQL Injection via the
sort parameter of the API interface, which can be exploited by authenticated users.Recommendations
For openITCOCKPIT version 4.6.4, update to version 4.6.5 to resolve the issue.
As a temporary workaround, consider restricting access to the API interface or avoiding the use of the
sort parameter until the update is applied.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openitcockpit