GitHub Advisory DatabaseGHSA-4QGH-M9VP-48XPMunkiReport Software Update module is vulnerable to SQL injection
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
47.2%
A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| munkireport | softwareupdate | * | cpe:2.3:a:munkireport:softwareupdate:*:*:*:*:*:*:*:* |
References
github.com/advisories/GHSA-4qgh-m9vp-48xp
github.com/munkireport/munkireport-php/releases
github.com/munkireport/munkireport-php/releases/tag/v5.6.3
github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-in-softwareupdate-module
github.com/munkireport/softwareupdate/releases
nvd.nist.gov/vuln/detail/CVE-2020-15887
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
47.2%