Description (CNA)
A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| The Foreman Project / katello | affected 3.10 and older |
CWE
CWE-89, CWE-209
References
ADP enrichment
No English description supplied.