SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2012-0805

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3)…

HIGH 7.5EPSS 2.89%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.89%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.

CVSS 2.0
7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
2.89% probability · 86th percentile
CISA KEV
Not listed
Weakness
CWE-89
Affected
sqlalchemy/sqlalchemy
Source
secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.