CVE-2017-15367 Bacula-web SQL Injection Vulnerabilities
CriticalCVSS 9.8
EPSS 23.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bacula-web/bacula-web(Packagist) | < 8.0.0-rc2 | 8.0.0-rc2 |
| bacula-web/bacula-web(Packagist) | = v8.0.0-rc.1 | No fix listed |
| bacula-web | <= 7.4.0 | No fix listed |
| bacula-web | = 8.0.0-rc1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com product
- web.archive.org
- web.archive.org
- 44272 exploit third-party-advisory vdb-entry
- github.com
- bacula-web.org release-notes vendor-advisory
- bugs.bacula-web.org issue-tracking vendor-advisory