CVE-2015-10077 – webbuilders-group/silverstripe-kapost-bridge

Package

Manager: composer
Name: webbuilders-group/silverstripe-kapost-bridge
Vulnerable Version: >=0 <0.4.0

Severity

Level: Critical

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00044 pctl0.12668

Details

SQL injection in webbuilders-group silverstripe-kapost-bridge A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 0.4.0 is able to address this issue. The name of the patch is 2e14b0fd0ea35034f90890f364b130fb4645ff35. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220471.

Metadata

Created: 2023-02-10T15:30:28Z
Modified: 2023-02-16T23:33:30Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-32gr-x76g-267w/GHSA-32gr-x76g-267w.json
CWE IDs: ["CWE-89"]
Alternative ID: GHSA-32gr-x76g-267w
Finding: F297
Auto approve: 1