DATABASE RESOURCES PRICING ABOUT US

{"id": "OPENVAS:136141256231070786", "type": "openvas", "bulletinFamily": "scanner", "title": "Gentoo Security Advisory GLSA 201110-23 (mod_authnz_external)", "description": "The remote host is missing updates announced in\nadvisory GLSA 201110-23.", "published": "2012-02-12T00:00:00", "modified": "2018-10-12T00:00:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "http://plugins.openvas.org/nasl.php?oid=136141256231070786", "reporter": "Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com", "references": ["http://bugs.gentoo.org/show_bug.cgi?id=386165", "http://www.securityspace.com/smysecure/catid.html?in=GLSA%20201110-23"], "cvelist": ["CVE-2011-2688"], "lastseen": "2019-05-29T18:38:38", "viewCount": 2, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2011-2688"]}, {"type": "debian", "idList": ["DEBIAN:BSA-042:A3B69", "DEBIAN:DSA-2279-1:127D6"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2011-2688"]}, {"type": "gentoo", "idList": ["GLSA-201110-23"]}, {"type": "nessus", "idList": ["DEBIAN_DSA-2279.NASL", "GENTOO_GLSA-201110-23.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:136141256231069988", "OPENVAS:69988", "OPENVAS:70786"]}, {"type": "osv", "idList": ["OSV:DSA-2279-1"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:26677", "SECURITYVULNS:DOC:27267", "SECURITYVULNS:VULN:11801", "SECURITYVULNS:VULN:12022"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2011-2688"]}]}, "score": {"value": 0.3, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2011-2688"]}, {"type": "debian", "idList": ["DEBIAN:BSA-042:A3B69"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2011-2688"]}, {"type": "gentoo", "idList": ["GLSA-201110-23"]}, {"type": "nessus", "idList": ["DEBIAN_DSA-2279.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:69988"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:12022"]}]}, "exploitation": null, "vulnersScore": 0.3}, "pluginID": "136141256231070786", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: glsa_201110_23.nasl 11859 2018-10-12 08:53:01Z cfischer $\n#\n# Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.70786\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2011-2688\");\n script_version(\"$Revision: 11859 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 10:53:01 +0200 (Fri, 12 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-12 10:04:40 -0500 (Sun, 12 Feb 2012)\");\n script_name(\"Gentoo Security Advisory GLSA 201110-23 (mod_authnz_external)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name:\"insight\", value:\"An input sanitation flaw in mod_authnz_external allows remote\n attacker to conduct SQL injection.\");\n script_tag(name:\"solution\", value:\"All Apache mod_authnz_external users should upgrade to the latest\n version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=www-apache/mod_authnz_external-3.2.6'\");\n\n script_xref(name:\"URL\", value:\"http://www.securityspace.com/smysecure/catid.html?in=GLSA%20201110-23\");\n script_xref(name:\"URL\", value:\"http://bugs.gentoo.org/show_bug.cgi?id=386165\");\n script_tag(name:\"summary\", value:\"The remote host is missing updates announced in\nadvisory GLSA 201110-23.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-gentoo.inc\");\ninclude(\"revisions-lib.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = ispkgvuln(pkg:\"www-apache/mod_authnz_external\", unaffected: make_list(\"ge 3.2.6\"), vulnerable: make_list(\"lt 3.2.6\"))) != NULL ) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "naslFamily": "Gentoo Local Security Checks", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1660004461, "score": 1659908672}, "_internal": {"score_hash": "60ce959cd3b8566feb7b6e574dd720a0"}}

{"openvas": [{"lastseen": "2017-07-24T12:55:35", "description": "The remote host is missing an update to libapache2-mod-authnz-external\nannounced via advisory DSA 2279-1.", "cvss3": {}, "published": "2011-08-03T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2279-1 (libapache2-mod-authnz-external)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2688"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:69988", "href": "http://plugins.openvas.org/nasl.php?oid=69988", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2279_1.nasl 6613 2017-07-07 12:08:40Z cfischer $\n# Description: Auto-generated from advisory DSA 2279-1 (libapache2-mod-authnz-external)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"It was discovered that libapache2-mod-authnz-external, an apache\nauthentication module, is prone to an SQL injection via the $user\nparameter.\n\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 3.2.4-2+squeeze1.\n\nThe oldstable distribution (lenny) does not contain\nlibapache2-mod-authnz-external\n\nFor the testing distribution (wheezy), this problem will be fixed soon.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.4-2.1.\n\n\nWe recommend that you upgrade your libapache2-mod-authnz-external packages.\";\ntag_summary = \"The remote host is missing an update to libapache2-mod-authnz-external\nannounced via advisory DSA 2279-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202279-1\";\n\n\nif(description)\n{\n script_id(69988);\n script_version(\"$Revision: 6613 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:08:40 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-03 04:36:20 +0200 (Wed, 03 Aug 2011)\");\n script_cve_id(\"CVE-2011-2688\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"Debian Security Advisory DSA 2279-1 (libapache2-mod-authnz-external)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libapache2-mod-authnz-external\", ver:\"3.2.4-2+squeeze1\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:39:47", "description": "The remote host is missing an update to libapache2-mod-authnz-external\nannounced via advisory DSA 2279-1.", "cvss3": {}, "published": "2011-08-03T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2279-1 (libapache2-mod-authnz-external)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2688"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:136141256231069988", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231069988", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2279_1.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Description: Auto-generated from advisory DSA 2279-1 (libapache2-mod-authnz-external)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.69988\");\n script_version(\"$Revision: 14275 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-03 04:36:20 +0200 (Wed, 03 Aug 2011)\");\n script_cve_id(\"CVE-2011-2688\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"Debian Security Advisory DSA 2279-1 (libapache2-mod-authnz-external)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB6\");\n script_xref(name:\"URL\", value:\"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202279-1\");\n script_tag(name:\"insight\", value:\"It was discovered that libapache2-mod-authnz-external, an apache\nauthentication module, is prone to an SQL injection via the $user\nparameter.\n\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 3.2.4-2+squeeze1.\n\nThe oldstable distribution (lenny) does not contain\nlibapache2-mod-authnz-external\n\nFor the testing distribution (wheezy), this problem will be fixed soon.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.4-2.1.\");\n\n script_tag(name:\"solution\", value:\"We recommend that you upgrade your libapache2-mod-authnz-external packages.\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update to libapache2-mod-authnz-external\nannounced via advisory DSA 2279-1.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libapache2-mod-authnz-external\", ver:\"3.2.4-2+squeeze1\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2017-07-24T12:50:33", "description": "The remote host is missing updates announced in\nadvisory GLSA 201110-23.", "cvss3": {}, "published": "2012-02-12T00:00:00", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201110-23 (mod_authnz_external)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2688"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:70786", "href": "http://plugins.openvas.org/nasl.php?oid=70786", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"An input sanitation flaw in mod_authnz_external allows remote\n attacker to conduct SQL injection.\";\ntag_solution = \"All Apache mod_authnz_external users should upgrade to the latest\n version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=www-apache/mod_authnz_external-3.2.6'\n \n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20201110-23\nhttp://bugs.gentoo.org/show_bug.cgi?id=386165\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 201110-23.\";\n\n \n \nif(description)\n{\n script_id(70786);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2011-2688\");\n script_version(\"$Revision: 6593 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:18:14 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-12 10:04:40 -0500 (Sun, 12 Feb 2012)\");\n script_name(\"Gentoo Security Advisory GLSA 201110-23 (mod_authnz_external)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\nres = \"\";\nreport = \"\";\nif((res = ispkgvuln(pkg:\"www-apache/mod_authnz_external\", unaffected: make_list(\"ge 3.2.6\"), vulnerable: make_list(\"lt 3.2.6\"))) != NULL ) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:43", "description": "SQL injection via username.", "edition": 1, "cvss3": {}, "published": "2011-07-22T00:00:00", "title": "Apache mod_authnz_external module SQL injection", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2011-2688"], "modified": "2011-07-22T00:00:00", "id": "SECURITYVULNS:VULN:11801", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:11801", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:42", "description": "- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\nGentoo Linux Security Advisory GLSA 201110-23\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n http://security.gentoo.org/\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n\r\n Severity: Low\r\n Title: Apache mod_authnz_external: SQL injection\r\n Date: October 25, 2011\r\n Bugs: #386165\r\n ID: 201110-23\r\n\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n\r\nSynopsis\r\n========\r\n\r\nAn input sanitation flaw in mod_authnz_external allows remote attacker\r\nto conduct SQL injection.\r\n\r\nBackground\r\n==========\r\n\r\nmod_authnz_external is a tool for creating custom authentication\r\nbackends for HTTP basic authentication.\r\n\r\nAffected packages\r\n=================\r\n\r\n -------------------------------------------------------------------\r\n Package / Vulnerable / Unaffected\r\n -------------------------------------------------------------------\r\n 1 www-apache/mod_authnz_external\r\n &lt; 3.2.6 &gt;= 3.2.6 \r\n\r\nDescription\r\n===========\r\n\r\nmysql/mysql-auth.pl in mod_authnz_external does not properly sanitize\r\ninput before using it in an SQL query.\r\n\r\nImpact\r\n======\r\n\r\nA remote attacker could exploit this vulnerability to inject arbitrary\r\nSQL statements by using a specially crafted username for HTTP\r\nauthentication on a site using mod_authnz_external.\r\n\r\nWorkaround\r\n==========\r\n\r\nThere is no known workaround at this time.\r\n\r\nResolution\r\n==========\r\n\r\nAll Apache mod_authnz_external users should upgrade to the latest\r\nversion:\r\n\r\n # emerge --sync\r\n # emerge --ask --oneshot -v &quot;&gt;=www-apache/mod_authnz_external-3.2.6&quot;\r\n\r\nReferences\r\n==========\r\n\r\n[ 1 ] CVE-2011-2688\r\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2688\r\n\r\nAvailability\r\n============\r\n\r\nThis GLSA and any updates to it are available for viewing at\r\nthe Gentoo Security Website:\r\n\r\n http://security.gentoo.org/glsa/glsa-201110-23.xml\r\n\r\nConcerns?\r\n=========\r\n\r\nSecurity is a primary focus of Gentoo Linux and ensuring the\r\nconfidentiality and security of our users&#39; machines is of utmost\r\nimportance to us. Any security concerns should be addressed to\r\nsecurity@gentoo.org or alternatively, you may file a bug at\r\nhttps://bugs.gentoo.org.\r\n\r\nLicense\r\n=======\r\n\r\nCopyright 2011 Gentoo Foundation, Inc; referenced text\r\nbelongs to its owner&#40;s&#41;.\r\n\r\nThe contents of this document are licensed under the\r\nCreative Commons - Attribution / Share Alike license.\r\n\r\nhttp://creativecommons.org/licenses/by-sa/2.5", "edition": 1, "cvss3": {}, "published": "2011-11-06T00:00:00", "title": "[ GLSA 201110-23 ] Apache mod_authnz_external: SQL injection", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2011-2688"], "modified": "2011-11-06T00:00:00", "id": "SECURITYVULNS:DOC:27267", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:27267", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:41", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2279-1 security@debian.org\r\nhttp://www.debian.org/security/ Steffen Joeris\r\nJuly 19, 2011 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : libapache2-mod-authnz-external\r\nVulnerability : SQL injection\r\nProblem type : remote\r\nDebian-specific: no\r\nCVE ID : CVE-2011-2688 \r\nDebian Bug : 633637\r\n\r\nIt was discovered that libapache2-mod-authnz-external, an apache\r\nauthentication module, is prone to an SQL injection via the $user\r\nparamter.\r\n\r\n\r\nFor the stable distribution &#40;squeeze&#41;, this problem has been fixed in\r\nversion 3.2.4-2+squeeze1.\r\n\r\nThe oldstable distribution &#40;lenny&#41; does not contain\r\nlibapache2-mod-authnz-external\r\n\r\nFor the testing distribution &#40;wheezy&#41;, this problem will be fixed soon.\r\n\r\nFor the unstable distribution &#40;sid&#41;, this problem has been fixed in\r\nversion 3.2.4-2.1.\r\n\r\n\r\nWe recommend that you upgrade your libapache2-mod-authnz-external packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.11 &#40;GNU/Linux&#41;\r\n\r\niEYEARECAAYFAk4k068ACgkQ62zWxYk/rQdEcACgl9otukAtTDPLIWRr8b7JlbCn\r\ngKYAniArSm7L6ND92ROY1fVsDgiKXD7R\r\n=07Sp\r\n-----END PGP SIGNATURE-----\r\n\r\n\r\n\r\n", "edition": 1, "cvss3": {}, "published": "2011-07-22T00:00:00", "title": "[SECURITY] [DSA 2279-1] libapache2-mod-authnz-external security update", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2011-2688"], "modified": "2011-07-22T00:00:00", "id": "SECURITYVULNS:DOC:26677", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:26677", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2021-06-08T18:53:59", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "edition": 2, "cvss3": {}, "published": "2011-11-06T00:00:00", "title": "Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2011-4136", "CVE-2011-1359", "CVE-2011-4074", "CVE-2011-4137", "CVE-2011-2773", "CVE-2011-4140", "CVE-2011-2772", "CVE-2011-4138", "CVE-2011-4075", "CVE-2011-2688", "CVE-2011-2771", "CVE-2011-4139"], "modified": "2011-11-06T00:00:00", "id": "SECURITYVULNS:VULN:12022", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:12022", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "debian": [{"lastseen": "2021-10-22T00:18:01", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2279-1 security@debian.org\nhttp://www.debian.org/security/ Steffen Joeris\nJuly 19, 2011 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : libapache2-mod-authnz-external\nVulnerability : SQL injection\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2011-2688 \nDebian Bug : 633637\n\nIt was discovered that libapache2-mod-authnz-external, an apache\nauthentication module, is prone to an SQL injection via the $user\nparamter.\n\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 3.2.4-2+squeeze1.\n\nThe oldstable distribution (lenny) does not contain\nlibapache2-mod-authnz-external\n\nFor the testing distribution (wheezy), this problem will be fixed soon.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.4-2.1.\n\n\nWe recommend that you upgrade your libapache2-mod-authnz-external packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2011-07-19T00:49:15", "type": "debian", "title": "[SECURITY] [DSA 2279-1] libapache2-mod-authnz-external security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2688"], "modified": "2011-07-19T00:49:15", "id": "DEBIAN:DSA-2279-1:127D6", "href": "https://lists.debian.org/debian-security-announce/2011/msg00153.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-04T02:08:00", "description": "Amaya Rodrigo uploaded new packages for libapache2-mod-authnz-external\nwhich fixed the following security problems:\n\nCVE-2011-2688 \n\tRemotely exploitable SQL injection in the mysql auth module.\n\nFor the lenny-backports distribution the problems have been fixed in\nversion 3.2.4-2~bpo50+1.1.\n\nFor the stable distribution (squeeze) the problems have been fixed in\nversion 3.2.4-2.1+squeeze1.\n\nIf you don&#x27;t use pinning (see [1]) you have to update the package\nmanually via &quot;apt-get -t lenny-backports install &lt;packagelist&gt;&quot; with the\npackagelist of your installed packages affected by this update.\n[1] &lt;http://backports.debian.org/Instructions&gt;\n\nWe recommend to pin (in /etc/apt/preferences) the backports repository\nto 200 so that new versions of installed backports will be installed\nautomatically.\n\n Package: *\n Pin: release a=lenny-backports\n Pin-Priority: 200\n\n\n-- \n .&#x27;&#x27;`. Ex nihilo nihil fit\n: :&#x27; :\n`. `&#x27;\n `- Proudly running Debian GNU/Linux\nAttachment:\nsignature.asc\nDescription: Digital signature\n", "cvss3": {}, "published": "2011-07-18T09:12:30", "type": "debian", "title": "[BSA-042] Security Update for libapache2-mod-authnz-external", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2688"], "modified": "2011-07-18T09:12:30", "id": "DEBIAN:BSA-042:A3B69", "href": "https://lists.debian.org/debian-backports-announce/2011/08/msg00000.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2021-08-19T13:00:09", "description": "It was discovered that libapache2-mod-authnz-external, an apache authentication module, is prone to a SQL injection via the $user parameter.", "cvss3": {"score": null, "vector": null}, "published": "2011-07-20T00:00:00", "type": "nessus", "title": "Debian DSA-2279-1 : libapache2-mod-authnz-external - SQL injection", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2688"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:libapache2-mod-authnz-external", "cpe:/o:debian:debian_linux:6.0"], "id": "DEBIAN_DSA-2279.NASL", "href": "https://www.tenable.com/plugins/nessus/55624", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2279. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(55624);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2011-2688\");\n script_bugtraq_id(48653);\n script_xref(name:\"DSA\", value:\"2279\");\n\n script_name(english:\"Debian DSA-2279-1 : libapache2-mod-authnz-external - SQL injection\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that libapache2-mod-authnz-external, an apache\nauthentication module, is prone to a SQL injection via the $user\nparameter.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633637\"\n );\n # https://packages.debian.org/source/squeeze/libapache2-mod-authnz-external\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?dce35710\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2011/dsa-2279\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the libapache2-mod-authnz-external packages.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 3.2.4-2+squeeze1.\n\nThe oldstable distribution (lenny) does not contain\nlibapache2-mod-authnz-external.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libapache2-mod-authnz-external\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/07/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/07/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libapache2-mod-authnz-external\", reference:\"3.2.4-2+squeeze1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-08-19T12:59:41", "description": "The remote host is affected by the vulnerability described in GLSA-201110-23 (Apache mod_authnz_external: SQL injection)\n\n mysql/mysql-auth.pl in mod_authnz_external does not properly sanitize input before using it in a SQL query.\n Impact :\n\n A remote attacker could exploit this vulnerability to inject arbitrary SQL statements by using a specially crafted username for HTTP authentication on a site using mod_authnz_external.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {"score": null, "vector": null}, "published": "2011-10-26T00:00:00", "type": "nessus", "title": "GLSA-201110-23 : Apache mod_authnz_external: SQL injection", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2688"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:mod_authnz_external", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201110-23.NASL", "href": "https://www.tenable.com/plugins/nessus/56635", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201110-23.\n#\n# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(56635);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2011-2688\");\n script_bugtraq_id(48653);\n script_xref(name:\"GLSA\", value:\"201110-23\");\n\n script_name(english:\"GLSA-201110-23 : Apache mod_authnz_external: SQL injection\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201110-23\n(Apache mod_authnz_external: SQL injection)\n\n mysql/mysql-auth.pl in mod_authnz_external does not properly sanitize\n input before using it in a SQL query.\n \nImpact :\n\n A remote attacker could exploit this vulnerability to inject arbitrary\n SQL statements by using a specially crafted username for HTTP\n authentication on a site using mod_authnz_external.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201110-23\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Apache mod_authnz_external users should upgrade to the latest\n version:\n # emerge --sync\n # emerge --ask --oneshot --verbose\n '>=www-apache/mod_authnz_external-3.2.6'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:mod_authnz_external\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/10/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/10/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"www-apache/mod_authnz_external\", unaffected:make_list(\"ge 3.2.6\"), vulnerable:make_list(\"lt 3.2.6\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Apache mod_authnz_external\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "gentoo": [{"lastseen": "2022-01-17T19:13:24", "description": "### Background\n\nmod_authnz_external is a tool for creating custom authentication backends for HTTP basic authentication. \n\n### Description\n\nmysql/mysql-auth.pl in mod_authnz_external does not properly sanitize input before using it in an SQL query. \n\n### Impact\n\nA remote attacker could exploit this vulnerability to inject arbitrary SQL statements by using a specially crafted username for HTTP authentication on a site using mod_authnz_external. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Apache mod_authnz_external users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=www-apache/mod_authnz_external-3.2.6\"", "cvss3": {}, "published": "2011-10-25T00:00:00", "type": "gentoo", "title": "Apache mod_authnz_external: SQL injection", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2688"], "modified": "2011-10-25T00:00:00", "id": "GLSA-201110-23", "href": "https://security.gentoo.org/glsa/201110-23", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "ubuntucve": [{"lastseen": "2022-08-04T14:32:58", "description": "SQL injection vulnerability in mysql/mysql-auth.pl in the\nmod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server\nallows remote attackers to execute arbitrary SQL commands via the user\nfield.", "cvss3": {}, "published": "2011-07-28T00:00:00", "type": "ubuntucve", "title": "CVE-2011-2688", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2688"], "modified": "2011-07-28T00:00:00", "id": "UB:CVE-2011-2688", "href": "https://ubuntu.com/security/CVE-2011-2688", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2022-03-23T12:14:20", "description": "SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.", "cvss3": {}, "published": "2011-07-28T18:55:00", "type": "cve", "title": "CVE-2011-2688", "cwe": ["CWE-89"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2688"], "modified": "2020-11-16T20:47:00", "cpe": ["cpe:/o:debian:debian_linux:7.0", "cpe:/o:debian:debian_linux:5.0", "cpe:/o:debian:debian_linux:6.0", "cpe:/a:mod_authnz_external_project:mod_authnz_external:3.2.5"], "id": "CVE-2011-2688", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2688", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*", "cpe:2.3:a:mod_authnz_external_project:mod_authnz_external:3.2.5:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*"]}], "debiancve": [{"lastseen": "2022-07-04T06:00:07", "description": "SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.", "cvss3": {}, "published": "2011-07-28T18:55:00", "type": "debiancve", "title": "CVE-2011-2688", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2688"], "modified": "2011-07-28T18:55:00", "id": "DEBIANCVE:CVE-2011-2688", "href": "https://security-tracker.debian.org/tracker/CVE-2011-2688", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "osv": [{"lastseen": "2022-08-10T07:08:48", "description": "\nIt was discovered that libapache2-mod-authnz-external, an apache\nauthentication module, is prone to an SQL injection via the $user\nparameter.\n\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 3.2.4-2+squeeze1.\n\n\nThe oldstable distribution (lenny) does not contain\nlibapache2-mod-authnz-external.\n\n\nFor the testing distribution (wheezy), this problem will be fixed soon.\n\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.4-2.1.\n\n\nWe recommend that you upgrade your libapache2-mod-authnz-external packages.\n\n\n", "cvss3": {}, "published": "2011-07-19T00:00:00", "type": "osv", "title": "libapache2-mod-authnz-external - SQL injection", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2688"], "modified": "2022-08-10T07:08:45", "id": "OSV:DSA-2279-1", "href": "https://osv.dev/vulnerability/DSA-2279-1", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}