PT-2019-8796 · Apache · Apache Vcl

Publicado 2019-07-29 · Atualizado 2019-08-07 · CVE-2018-11772

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache VCL versions 2.1 through 2.5

Description The issue arises from improper validation of cookie input when determining the previously selected node in the privilege tree. This input is then used in an SQL statement, allowing for an SQL injection attack. Access to the vulnerable portion of the system requires admin-level rights, and other security layers seem to protect against malicious attacks. It is estimated that all VCL systems running versions earlier than 2.5.1 are potentially affected.

Recommendations For Apache VCL versions 2.1 through 2.5, upgrade or patch to a version 2.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the privilege tree functionality to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-11772

Produtos afetados

Apache Vcl

Referências · 5

• https://osv.dev/vulnerability/CVE-2018-11772 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11772 · Nota de Segurança
• https://lists.apache.org/thread.html/ffde9f87d0730ba6d4e1242eda56c1f1d6d0802ee4eda36fc1be3aaa%40%3Cannounce.apache.org%3E · Nota
• https://lists.apache.org/thread.html/a468c473b4c418307b9866fe4c613630a2efc46bed53438b6af1f55c%40%3Cdev.vcl.apache.org%3E · Nota
• https://t.me/cibsecurity/5787 · Publicação no Telegram