CVE-2011-0432 PyWebDAV SQL Injection vulnerability
HighCVSS 7.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pywebdav(PyPI) | < 0.9.4.1 | 0.9.4.1 |
| pypi pywebdav(PyPI) | = 0.6 | No fix listed |
| pypi pywebdav(PyPI) | = 0.7 | No fix listed |
| pypi pywebdav(PyPI) | = 0.8 | No fix listed |
| pypi pywebdav(PyPI) | = 0.9 | No fix listed |
| pypi pywebdav(PyPI) | = 0.9.1 | No fix listed |
| pypi pywebdav(PyPI) | = 0.9.2 | No fix listed |
| pypi pywebdav(PyPI) | = 0.9.3 | No fix listed |
| pypi pywebdav(PyPI) | = 0.9.4 | No fix listed |
| simon pamies pywebdav | <= 0.9.4 | No fix listed |
| simon pamies pywebdav | = 0.3 | No fix listed |
| simon pamies pywebdav | = 0.5 | No fix listed |
| simon pamies pywebdav | = 0.5.1 | No fix listed |
| simon pamies pywebdav | = 0.6 | No fix listed |
| simon pamies pywebdav | = 0.7 | No fix listed |
| simon pamies pywebdav | = 0.8 | No fix listed |
| simon pamies pywebdav | = 0.9.1 | No fix listed |
| simon pamies pywebdav | = 0.9.2 | No fix listed |
| simon pamies pywebdav | = 0.9.3 | No fix listed |
| debian/pywebdav(Debian:12) | < 0.9.4-3 | 0.9.4-3 |
| debian/pywebdav(Debian:13) | < 0.9.4-3 | 0.9.4-3 |
| debian/pywebdav(Debian:14) | < 0.9.4-3 | 0.9.4-3 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking
- github.com product
- github.com
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- code.google.com patch
- FEDORA-2011-2460 vendor-advisory
- FEDORA-2011-2470 vendor-advisory
- FEDORA-2011-2427 vendor-advisory
- pywebdav.googlecode.com patch
- 43571 third-party-advisory vendor-advisory
- 43602 third-party-advisory vendor-advisory
- DSA-2177 vendor-advisory
- ADV-2011-0553 vdb-entry vendor-advisory
- ADV-2011-0554 vdb-entry vendor-advisory
- 43703 third-party-advisory vendor-advisory
- ADV-2011-0634 vdb-entry vendor-advisory
- 46655 vdb-entry
- github.com vendor-advisory
- Debian Security Tracker CVE-2011-0432 vendor-advisory