CVE-2018-11772: SQL Injection
First published: Mon Jul 29 2019(Updated: )
Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Virtual Computing Lab | >=2.1<=2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/a468c473b4c418307b9866fe4c613630a2efc46bed53438b6af1f55c@%3Cdev.vcl.apache.org%3E
- https://lists.apache.org/thread.html/ffde9f87d0730ba6d4e1242eda56c1f1d6d0802ee4eda36fc1be3aaa@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/a468c473b4c418307b9866fe4c613630a2efc46bed53438b6af1f55c%40%3Cdev.vcl.apache.org%3E
- https://lists.apache.org/thread.html/ffde9f87d0730ba6d4e1242eda56c1f1d6d0802ee4eda36fc1be3aaa%40%3Cannounce.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2018-11772?
CVE-2018-11772 is classified as a high severity vulnerability due to its potential to allow SQL injection attacks.
How do I fix CVE-2018-11772?
To fix CVE-2018-11772, upgrade Apache Virtual Computing Lab to version 2.6 or later where the cookie input validation has been improved.
What versions of Apache VCL are affected by CVE-2018-11772?
CVE-2018-11772 affects Apache VCL versions 2.1 through 2.5.
What type of attack is possible with CVE-2018-11772?
CVE-2018-11772 allows for an SQL injection attack when improperly validated cookie input is used in SQL statements.
Is administrative access required to exploit CVE-2018-11772?
Yes, administrative access is required to exploit the SQL injection vulnerability in CVE-2018-11772.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/apache
- canonical/apache virtual computing lab
- version/apache virtual computing lab/2.1
- version/apache virtual computing lab/2.5