CVE-2019-6986 Command Injection in VIVO Vitro
HighCVSS 7.5
EPSS 3.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of service (ReDoS), as demonstrated by crafted use of FILTER%20regex in a /individual?uri= request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.vivoweb/vitro-project(Maven) | < 1.11.0 | 1.11.0 |
| org.vivoweb/vitro-project(Maven) | = 1.10.0 | No fix listed |
| org.vivoweb/vitro-project(Maven) | = 1.10.0-alpha1 | No fix listed |
| org.vivoweb/vitro-project(Maven) | = 1.10.0-alpha2 | No fix listed |
| org.vivoweb/vitro-project(Maven) | = 1.10.0-beta1 | No fix listed |
| org.vivoweb/vitro-project(Maven) | = 1.10.0-beta2 | No fix listed |
| org.vivoweb/vitro-project(Maven) | = 1.9.0 | No fix listed |
| org.vivoweb/vitro-project(Maven) | = 1.9.0-alpha-1 | No fix listed |
| org.vivoweb/vitro-project(Maven) | = 1.9.0-alpha-2 | No fix listed |
| org.vivoweb/vitro-project(Maven) | = 1.9.0-rc1 | No fix listed |
| org.vivoweb/vitro-project(Maven) | = 1.9.1 | No fix listed |
| org.vivoweb/vitro-project(Maven) | = 1.9.2 | No fix listed |
| org.vivoweb/vitro-project(Maven) | = 1.9.3 | No fix listed |
| duraspace vitro | = 1.10.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com patch
- jira.duraspace.org
- github.com exploit third-party-advisory
- packetstormsecurity.com exploit
- github.com
- github.com product