SB2018072502 - Debian update for slurm-llnl

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018072502

SB2018072502 - Debian update for slurm-llnl

Published: July 25, 2018

Security Bulletin ID SB2018072502
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) SQL injection (CVE-ID: CVE-2018-7033)

The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in web application database.

Successful exploitation of the vulnerability may allow an attacker to gain administrative access to vulnerable web application.


2) Security restrictions bypass (CVE-ID: CVE-2018-10995)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to the application mishandles user names (aka user_name fields) and group ids (aka gid fields). A remote unauthenticated attacker can bypass security restrictions and conduct further attacks.


Remediation

Install update from vendor's website.

References