CVE-2018-1000552

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "dateAssigned": "2018-06-23T00:00:00.000Z", "datePublic": "2018-06-26T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-06-26T15:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "DATE_ASSIGNED": "2018-06-23T11:22:33.076459", "DATE_REQUESTED": "2018-04-30T09:00:12", "ID": "CVE-2018-1000552", "REQUESTER": "robin.verton@telekom.de", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html", "refsource": "MISC", "url": "https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T12:40:47.292Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-1000552", "datePublished": "2018-06-26T16:00:00.000Z", "dateReserved": "2018-04-30T00:00:00.000Z", "dateUpdated": "2024-08-05T12:40:47.292Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trovebox:trovebox:*:*:*:*:*:*:*:*", "matchCriteriaId": "78F6699A-A397-4D6A-970A-E7123622C5CF", "versionEndIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:trovebox:trovebox:4.0.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "BD80BAFE-28C1-49F1-AE8C-0E0BC943AA67", "vulnerable": true}, {"criteria": "cpe:2.3:a:trovebox:trovebox:4.0.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "8A011E31-96B1-4979-A4C4-83639B024693", "vulnerable": true}, {"criteria": "cpe:2.3:a:trovebox:trovebox:4.0.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "F6946C75-E3BE-475C-B4BB-B41EFE5D86ED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed."}, {"lang": "es", "value": "Trovebox, en versiones 4.0.0-rc6 y anteriores, contiene una vulnerabilidad de inyecci\u00f3n SQL en el componente album que puede resultar en la inyecci\u00f3n de c\u00f3digo SQL. Parece ser que este ataque puede ser explotado mediante una petici\u00f3n HTTP. La vulnerabilidad parece haber sido solucionada tras el commit con ID 742b8ed."}], "id": "CVE-2018-1000552", "lastModified": "2026-06-17T01:32:53.820", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-06-26T16:29:02.650", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}