PT-2020-8078 · Suse · Suse Studio

Johannes Segitz · Published 2020-01-27 · Updated 2020-02-04 · CVE-2017-14807

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SUSE Studio onsite susestudio-ui-server versions 1.3.17-56.6.3 and prior versions

Description: An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') issue allows remote attackers with admin privileges in Studio to alter SQL statements, enabling the extraction and modification of data.

Recommendations: For SUSE Studio onsite susestudio-ui-server versions 1.3.17-56.6.3 and prior versions, update to a version later than 1.3.17-56.6.3 to resolve the issue. As a temporary workaround, consider restricting access to the SQL commands to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-14807

Affected Products

Suse Studio

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-14807 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14807 · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1065396 · Note
• https://t.me/cvenotify/444 · Telegram Post