CVE-2018-1096

foreman: SQL injection due to improper handling of the widget id parameter

Published Apr 5, 2018 CVSS 3.0 · 6.5 Medium EPSS 1.3% KEV · Not listed
Description
An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2018-11746 An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Sep 16, 2024, 5:02 PM
Reserved
Dec 4, 2017, 12:00 AM
Status
Modified
Published
Apr 5, 2018, 9:29 PM
Modified
Jun 17, 2026, 1:50 AM
Severity
Moderate
Public date
Mar 28, 2018, 12:00 AM