CVE-2019-12149 - SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry module 2.1.x before 2.1.1 and 2.2.x before 2.2.1 allows attackers to execute arbitrary SQL commands

Back Back to CVE browser

CRITICAL

SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry module 2.1.x before 2.1.1 and 2.2.x before 2.2.1 allows attackers to execute arbitrary SQL commands

Published Jun 11, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 1.35%

Description

SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry module 2.1.x before 2.1.1 and 2.2.x before 2.2.1 allows attackers to execute arbitrary SQL commands.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2394
Advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/restfulserver/CVE-2019-12149.yaml
https://github.com/advisories/GHSA-4j6v-3895-8g2j
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-12149
https://www.silverstripe.org/download/security-releases/cve-2019-12149
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2394		Advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/restfulserver/CVE-2019-12149.yaml
https://github.com/advisories/GHSA-4j6v-3895-8g2j		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-12149
https://www.silverstripe.org/download/security-releases/cve-2019-12149		x_refsource_CONFIRMVendor Advisory