vulnwire
9.8crit

CVE-2017-15367in critical feed1 exploit

Bacula-web SQL Injection Vulnerabilities

Also known as GHSA-fv4m-5j2c-787r

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
23.1%
percentile 98%
Public exploits
1
Exploit-DB

Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.

Exploit prediction (EPSS)

23.07% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-44272 Bacula-Web < 8.0.0-rc2 - SQL Injection · webapps · 2018-03-09

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
packagistbacula-web/bacula-web
<8.0.0-rc2
8.0.0-rc2

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

  • bacula-web.org /download/articles/bacula-web-8-0-0-rc2.html · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/44272/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • bugs.bacula-web.org /view.php?id=211 · x_refsource_CONFIRM, x_transferred
  • github.com /bacula-web/bacula-web/commit/90d4c44a0dd0d65c6fb3ab2417b83d700c8413ae · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-15367 · advisory
  • github.com /bacula-web/bacula-web · package
  • web.archive.org /web/20180324124226/http://bacula-web.org/download/articles/bacula-web-8-0-0-rc2.html · web
  • web.archive.org /web/20180625090858/http://bugs.bacula-web.org/view.php?id=211 · web
  • exploit-db.com /exploits/44272 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.