PT-2019-8796 · Apache · Apache Vcl

Published 2019-07-29 · Updated 2019-08-07 · CVE-2018-11772

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache VCL versions 2.1 through 2.5

Description The issue arises from improper validation of cookie input when determining the previously selected node in the privilege tree. This input is then used in an SQL statement, allowing for an SQL injection attack. Access to the vulnerable portion of the system requires admin-level rights, and other security layers seem to protect against malicious attacks. It is estimated that all VCL systems running versions earlier than 2.5.1 are potentially affected.

Recommendations For Apache VCL versions 2.1 through 2.5, upgrade or patch to a version 2.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the privilege tree functionality to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-11772

Affected Products

Apache Vcl

References · 5

• https://osv.dev/vulnerability/CVE-2018-11772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11772 · Security Note
• https://lists.apache.org/thread.html/ffde9f87d0730ba6d4e1242eda56c1f1d6d0802ee4eda36fc1be3aaa%40%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/a468c473b4c418307b9866fe4c613630a2efc46bed53438b6af1f55c%40%3Cdev.vcl.apache.org%3E · Note
• https://t.me/cibsecurity/5787 · Telegram Post