CVE-2018-1000552

EUVD-2018-1941
Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 45%
Affected Products (NVD)
VendorProductVersion
troveboxtrovebox
𝑥
≤ 3.0.0
troveboxtrovebox
4.0.0:rc2
troveboxtrovebox
4.0.0:rc5
troveboxtrovebox
4.0.0:rc6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html
https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html