GitHub Advisoryadvisory · PyPI

GHSA-hfg2-wf6j-x53p SQLAlchemy vulnerable to SQL injection

CRITICAL Published 2022-05-14 Modified 2024-10-28 Official page ↗
Aliases
CVE-2012-0805
Ecosystem
PyPI
Packages
SQLAlchemy
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-04-30

Affected packages

• PyPI SQLAlchemy: < 0.7.0b4 → fixed in 0.7.0b4

Description

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.

Related

Alias · CVE (1)

  • CVE-2012-0805 Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References