Back to Database
Status published
Medium
CVE-2018-14623
A SQL injection flaw was found in katello's errata-related API....
Vulnerability Description
A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-14623
Credits & Attribution
No credits recorded in the NVD database.
References
More from The Foreman Project
View All →CVE-2019-3893
In Foreman it was discovered that the delete compute resource...
Medium
4.9
CVE-2019-10198
An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7....
Medium
6.5
CVE-2018-16861
A cross-site scripting (XSS) flaw was found in the foreman...
High
7.6
CVE-2017-2662
A flaw was found in Foreman's katello plugin version 3.4.5....
Medium
4.3
CVE-2016-8639
It was found that foreman before 1.13.0 is vulnerable to...
Medium
6.1
Affected Vendor
The Foreman Project
View all reports →Affected Software
katello
Vulnerable Versions:
3.10 and older
Timeline
Official Publish:
December 13th, 2018
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
MITRE ATT&CK TTPs
T1190
Exploit Public-Facing Application
Initial Access
T1059
Command and Scripting Interpreter
Execution
T1213.006
Databases
Collection
T1485
Data Destruction
Impact
T1592
Gather Victim Host Information
Reconnaissance
T1083
File and Directory Discovery
Discovery
T1552
Unsecured Credentials
Credential Access
T1212
Exploitation for Defense Evasion
Defense Evasion
T1005
Data from Local System
Collection