CVE-2019-10141

2019-07-3016:22:59

CWE-89

redhat

www.cve.org

8.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

9.1 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.1%

JSON

A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector’s node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.

CNA Affected

[
  {
    "product": "openstack-ironic-inspector",
    "vendor": "RedHat",
    "versions": [
      {
        "status": "affected",
        "version": "all 5.0.x up to, excluding 5.0.2"
      },
      {
        "status": "affected",
        "version": "all 6.0.x up to, excluding 6.0.3"
      },
      {
        "status": "affected",
        "version": "all 7.2.x up to, excluding 7.2.4"
      },
      {
        "status": "affected",
        "version": "all 8.0.3 up to, excluding 8.0.3"
      },
      {
        "status": "affected",
        "version": "8.2.0"
      }
    ]
  }
]