6.5
CVSSv2

CVE-2018-11772

Published: 29/07/2019 Updated: 07/08/2019
CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8
CVSS v3 Base Score: 7.2 | Impact Score: 5.9 | Exploitability Score: 1.2
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Vulnerability Summary

Apache VCL versions 2.1 up to and including 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.

Vulnerability Trend

Affected Products

Vendor Product Versions
ApacheVirtual Computing Lab2.1, 2.2, 2.2.1, 2.2.2, 2.3, 2.3.1, 2.3.2, 2.4, 2.4.1, 2.4.2, 2.5

Mailing Lists

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CVE-2018-11772: Apache VCL SQL injection attack in privilege management Severity: Medium Versions Affected: 21 through 25 Description: Apache VCL versions 21 through 25 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree ...