CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 4.0
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: a sql injection flaw was found in katello's errata-related api. an authenticated remote attacker can craft input data to force a malformed sql query to the backend database, which will leak internal ids. this is issue is related to an incomplete fix for cve-2016-3072. version 3.10 and older is vulnerable.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2018-12-14
Last Modified Date: 2019-10-09