CVE-2016-3072 | BDVDB-2026-76286 Detail

Description#

Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://access.redhat.com/errata/RHSA-2016:1083
https://bugzilla.redhat.com/show_bug.cgi?id=1322050
https://github.com/Katello/katello/pull/6051

Exploit#

No public exploit known

History#

Version 12016-06-07Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.