PT-2019-5491 · Sqlalchemy+5 · Sqlalchemy+5
Publicado
2019-01-07
·
Atualizado
2021-11-30
·
CVE-2019-7548
CVSS v4.0
9.3
Crítica
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
SQLAlchemy version 1.2.17
Description
The issue is related to SQL injection when the
group by parameter can be controlled, allowing an attacker to execute arbitrary code. This is due to a lack of protection measures for the SQL query structure.Recommendations
For SQLAlchemy version 1.2.17, consider restricting access to the
group by parameter to prevent its manipulation by unauthorized users. As a temporary workaround, avoid using the group by parameter in sensitive queries until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Almalinux
Centos
Red Hat
Rocky Linux
Sqlalchemy
Suse