CVE-2018-1000552

Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
VendorProductVersion
troveboxtrovebox
𝑥
≤ 3.0.0
troveboxtrovebox
4.0.0:rc2
troveboxtrovebox
4.0.0:rc5
troveboxtrovebox
4.0.0:rc6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html
https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html