Nixpkgs security tracker
Dismissed
Permalink
CVE-2020-37105
7.1 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse ignored package pmbootstrap
- @LeSuisse dismissed
PMB 5.6 - 'logid' SQL Injection
PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands through the 'logid' parameter. Attackers can leverage this vulnerability by sending crafted requests to the /admin/sauvegarde/download.php endpoint with manipulated logid values to interact with the database.
References
-
ExploitDB-48356 exploit
-
Vendor Homepage product
-
Software Download Repository product
-
VulnCheck Advisory: PMB 5.6 - 'logid' SQL Injection third-party-advisory
Affected products
PMB
- ==5.6
Ignored packages (1)
pkgs.pmbootstrap
Sophisticated chroot/build/flash tool to develop and install postmarketOS