CVE-2007-0347

2007-01-2920:28:00

[email protected]

web.nvd.nist.gov

cvstrac

sql injection

input validation

security vulnerability

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

7.3 High

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

81.3%

JSON

The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the “'” (quote) character, which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service (database error) via a ’ character in certain messages, tickets, or Wiki entries.

Affected configurations

NVD

Node

cvstraccvstracRange≤2.0

cvstraccvstracMatch1.1

cvstraccvstracMatch1.1.1

cvstraccvstracMatch1.1.2

cvstraccvstracMatch1.1.3

cvstraccvstracMatch1.1.4

CPENameOperatorVersion
cvstrac:cvstraccvstracle2.0
cvstrac:cvstraccvstraceq1.1
cvstrac:cvstraccvstraceq1.1.1
cvstrac:cvstraccvstraceq1.1.2
cvstrac:cvstraccvstraceq1.1.3
cvstrac:cvstraccvstraceq1.1.4

CPE	Name	Operator	Version
cvstrac:cvstrac	cvstrac	le	2.0
cvstrac:cvstrac	cvstrac	eq	1.1
cvstrac:cvstrac	cvstrac	eq	1.1.1
cvstrac:cvstrac	cvstrac	eq	1.1.2
cvstrac:cvstrac	cvstrac	eq	1.1.3
cvstrac:cvstrac	cvstrac	eq	1.1.4