Multiple Pivotal Products CVE-2017-4974 SQL Injection Vulnerability
BID:99254
Info
Multiple Pivotal Products CVE-2017-4974 SQL Injection Vulnerability
| Bugtraq ID: | 99254 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-4974 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 23 2017 12:00AM |
| Updated: | Jun 23 2017 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
Pivotal Software Cloud Foundry UAA BOSH 24.0 Pivotal Software Cloud Foundry UAA BOSH 13.0 Pivotal Software Cloud Foundry UAA 3.9 Pivotal Software Cloud Foundry UAA 3.6 Pivotal Software Cloud Foundry UAA 2.0 Pivotal Software Cloud Foundry UAA 2.7.4.12 Pivotal Software Cloud Foundry 252 |
| Not Vulnerable: |
Pivotal Software Cloud Foundry UAA BOSH 30.1 Pivotal Software Cloud Foundry UAA BOSH 24.8 Pivotal Software Cloud Foundry UAA BOSH 13.13 Pivotal Software Cloud Foundry UAA 3.16 Pivotal Software Cloud Foundry UAA 3.9.11 Pivotal Software Cloud Foundry UAA 3.6.9 Pivotal Software Cloud Foundry UAA 2.7.4.15 Pivotal Software Cloud Foundry 258 |
Discussion
Multiple Pivotal Products CVE-2017-4974 SQL Injection Vulnerability
Multiple Pivotal Products are prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following products are affected:
Cloud Foundry versions prior to v258
Cloud Foundry UAA 2.x versions prior to v2.7.4.15
Cloud Foundry UAA 3.6.x versions prior to v3.6.9
Cloud Foundry UAA 3.9.x versions prior to v3.9.11
Cloud Foundry UAA versions prior to v3.16.0
Cloud Foundry UAA bosh 13.x versions prior to v13.13
Cloud Foundry UAA bosh 24.x versions prior to v24.8
Cloud Foundry UAA bosh versions prior to v30.1
Multiple Pivotal Products are prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following products are affected:
Cloud Foundry versions prior to v258
Cloud Foundry UAA 2.x versions prior to v2.7.4.15
Cloud Foundry UAA 3.6.x versions prior to v3.6.9
Cloud Foundry UAA 3.9.x versions prior to v3.9.11
Cloud Foundry UAA versions prior to v3.16.0
Cloud Foundry UAA bosh 13.x versions prior to v13.13
Cloud Foundry UAA bosh 24.x versions prior to v24.8
Cloud Foundry UAA bosh versions prior to v30.1
Exploit / POC
Multiple Pivotal Products CVE-2017-4974 SQL Injection Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Multiple Pivotal Products CVE-2017-4974 SQL Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Multiple Pivotal Products CVE-2017-4974 SQL Injection Vulnerability
References:
References:
- Pivotal Homepage (Pivotal)
- CVE-2017-4974: Blind SQL Injection with privileged UAA endpoints (cloudfoundry.org)