CVE-2011-0432
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.
- EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- simon_pamies:pywebdav
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-69vw-jfq7-935g | PyPI | pywebdav | <0.9.4.1 | 0.9.4.1 |
| PYSEC-2011-7 | PyPI | pywebdav | <0.9.4.1 | 0.9.4.1 |
References
- http://code.google.com/p/pywebdav/updates/list
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055412.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055413.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055444.html
- http://pywebdav.googlecode.com/files/PyWebDAV-0.9.4.1.tar.gz