GitHub Advisoryadvisory · PyPI

GHSA-gmpq-xrxj-xh8m Arches vulnerable to execution of arbitrary SQL

HIGH Published 2022-11-11 Modified 2024-09-04 Official page ↗
Aliases
CVE-2022-41892
Ecosystem
PyPI
Packages
arches
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Weaknesses
CWE-89
Reviewed
2022-11-11

Affected packages

• PyPI arches: < 6.1.2 → fixed in 6.1.2 • PyPI arches: >= 6.2.0, < 6.2.1 → fixed in 6.2.1 • PyPI arches: >= 7.0.0, < 7.2.0 → fixed in 7.2.0

Description

Impact With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. Anyone running the impacted versions (=7.0.0, <=7.1.1) should upgrade as soon as possible. Patches The problem has been patched in the following versions: 6.1.2, 6.2.1, and 7.2.0 Users are strongly urged to upgrade to the most recent relevant patch. Workarounds There are no workarounds. General References https://www.w3schools.com/sql/sql_injection.asp https://en.wikipedia.org/wiki/SQL_injection For more information Post any questions to the Arches project forum.

Related

Alias · CVE (1)

  • CVE-2022-41892 Arches is a web platform for creating, managing, & visualizing geospatial data. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References