Project

General

Profile

Bug #23028

CVE-2018-1096: SQL injection in dashboard controller

Added by Tomer Brisker about 1 year ago. Updated 11 months ago.

Status:
Closed
Priority:
High
Assignee:
Category:
Security
Target version:
Team Backlog:
Fixed in Releases:
Found in Releases:

Description

Widget id is not properly escaped for save_positions action on the dashboard, leading to SQL injection possibility.
This only allows injecting conditions to the select conditions, as it is a prepared query it does not allow executing additional commands.
It is only available to authenticated users.

This issue was reported by Martin Povolný from Red Hat.


Related issues

Related to Foreman - Refactor #8106: Save dashboard widgets in DB to increase flexibilityClosed2014-10-26

Associated revisions

Revision 274665e2 (diff)
Added by Martin Povolny about 1 year ago

Fixes #23028 - Properly escape params passed to where (CVE-2018-1096) (#5363)

History

#1 Updated by Tomer Brisker about 1 year ago

  • Description updated (diff)

#2 Updated by Tomer Brisker about 1 year ago

  • Related to Refactor #8106: Save dashboard widgets in DB to increase flexibility added

#3 Updated by Tomer Brisker about 1 year ago

  • Private changed from Yes to No
  • Subject changed from SQL injection in dashboard controller to CVE-2018-1096: SQL injection in dashboard controller

#4 Updated by The Foreman Bot about 1 year ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/5363 added

#5 Updated by Tomer Brisker about 1 year ago

  • Legacy Backlogs Release (now unused) set to 332

#6 Updated by The Foreman Bot about 1 year ago

  • Pull request https://github.com/theforeman/foreman/pull/5364 added

#7 Updated by The Foreman Bot about 1 year ago

  • Pull request https://github.com/theforeman/foreman/pull/5365 added

#8 Updated by Martin Povolny about 1 year ago

  • % Done changed from 0 to 100
  • Status changed from Ready For Testing to Closed

Also available in: Atom PDF