PT-2019-14286 · Bedita · Bedita

Fquffio · Published 2019-08-26 · Updated 2022-05-24 · CVE-2019-15570

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BEdita versions prior to 4.0.0-RC2

Description The issue allows SQL injection during a save operation for a relation with parameters due to a lack of JSON escaping.

Recommendations For versions prior to 4.0.0-RC2, update to a version that includes proper JSON escaping to prevent SQL injection attacks.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-15570

GHSA-9GV2-2M38-J6CX

Affected Products

Bedita

References · 6

• https://github.com/bedita/bedita/pull/1608 · Patch
• https://osv.dev/vulnerability/CVE-2019-15570 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15570 · Security Note
• https://osv.dev/vulnerability/GHSA-9gv2-2m38-j6cx · Vendor Advisory
• https://github.com/bedita/bedita/commit/0ddcd46d645c773e69369f3ed82c865a4d098454 · Note
• https://github.com/bedita/bedita · Note