CVE-2019-11600: SQL Injection
A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11600?
CVE-2019-11600 is classified as a critical vulnerability due to its ability to enable remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2019-11600?
To fix CVE-2019-11600, upgrade OpenProject to version 8.3.2 or later, which addresses this SQL injection vulnerability.
Who is affected by CVE-2019-11600?
CVE-2019-11600 affects all versions of OpenProject prior to 8.3.2 that allow unauthenticated API access.
What impact does CVE-2019-11600 have on OpenProject users?
The impact of CVE-2019-11600 allows unauthorized users to perform SQL injection attacks, potentially compromising the integrity of the database.
Is authentication required to exploit CVE-2019-11600?
No, CVE-2019-11600 can be exploited without authentication if OpenProject's API is configured to allow unrestricted access.