GitHub Advisoryadvisory · PyPI

GHSA-hg4c-rgvm-964g SQL Injection in pycsw

CRITICAL Published 2018-08-15 Modified 2026-06-09 Official page ↗
Aliases
CVE-2016-8640
Ecosystem
PyPI
Packages
pycsw
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• PyPI pycsw: >= 2.0.0, < 2.0.2 → fixed in 2.0.2 • PyPI pycsw: < 1.8.6 → fixed in 1.8.6 • PyPI pycsw: >= 1.10.0, < 1.10.5 → fixed in 1.10.5

Description

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.

Related

Alias · CVE (1)

  • CVE-2016-8640 A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References