GitHub Advisoryadvisory · RubyGems

GHSA-527r-mfmj-prqf Katello SQL Injection vulnerabilities

HIGH Published 2022-05-14 Modified 2023-02-08 Official page ↗
Aliases
CVE-2016-3072
Ecosystem
RubyGems
Packages
katello
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2023-02-08

Affected packages

• RubyGems katello: < 2.4.3 → fixed in 2.4.3

Description

Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter.

Related

Alias · CVE (1)

  • CVE-2016-3072 Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References