CVSS 3.0
4.3 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2018-14623
Medium (4.3) in theforeman katello. EPSS 1.4% chance of exploitation in the next 30 days.
A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-89, CWE-209
- Published
- Modified
- Record from
- the NVD, synced
Affected
- theforeman:katello
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jx5v-788g-qw58 | RubyGems | katello | <=3.10 | no fix published |