CVE-2018-14623

katello: SQL inject in errata-related REST API

Published Dec 13, 2018 CVSS 3.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Description
A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-4457 A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.
Github GHSA Github GHSA GHSA-jx5v-788g-qw58 katello SQL Injection vulnerability
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 9:29 AM
Reserved
Jul 27, 2018, 12:00 AM
Status
Modified
Published
Dec 14, 2018, 12:29 AM
Modified
Jun 17, 2026, 1:41 AM
Severity
Low
Public date
Dec 12, 2018, 12:00 AM