CVE-2011-0432

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.

Múltiples vulnerabilidades de inyección SQL en la clases MySQLAuthHandler en DAVServer/mysqlauth.py de PyWebDAV en versiones anteriores a v0.9.4.1 , permite a atacantes remotos ejecutar comandos SQL de su elección a través de los parámetros (1) usuario o (2) password. NOTA : algunos de estos detalles han sido obtenidos de información de terceros .

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-01-12 CVE Reserved
2011-03-02 CVE Published
2024-09-16 CVE Updated
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CAPEC

References (14)

URL	Tag	Source
http://www.securityfocus.com/bid/46655	Vdb Entry
https://bugzilla.redhat.com/show_bug.cgi?id=677718	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC
http://code.google.com/p/pywebdav/updates/list	2011-03-15
http://pywebdav.googlecode.com/files/PyWebDAV-0.9.4.1.tar.gz	2011-03-15

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055412.html	2011-03-15
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055413.html	2011-03-15
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055444.html	2011-03-15
http://secunia.com/advisories/43571	2011-03-15
http://secunia.com/advisories/43602	2011-03-15
http://secunia.com/advisories/43703	2011-03-15
http://www.debian.org/security/2011/dsa-2177	2011-03-15
http://www.vupen.com/english/advisories/2011/0553	2011-03-15
http://www.vupen.com/english/advisories/2011/0554	2011-03-15
http://www.vupen.com/english/advisories/2011/0634	2011-03-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Simon Pamies Search vendor "Simon Pamies"		Pywebdav Search vendor "Simon Pamies" for product "Pywebdav"				<= 0.9.4 Search vendor "Simon Pamies" for product "Pywebdav" and version " <= 0.9.4"		-		Affected
Simon Pamies Search vendor "Simon Pamies"		Pywebdav Search vendor "Simon Pamies" for product "Pywebdav"				0.3 Search vendor "Simon Pamies" for product "Pywebdav" and version "0.3"		-		Affected
Simon Pamies Search vendor "Simon Pamies"		Pywebdav Search vendor "Simon Pamies" for product "Pywebdav"				0.5 Search vendor "Simon Pamies" for product "Pywebdav" and version "0.5"		-		Affected
Simon Pamies Search vendor "Simon Pamies"		Pywebdav Search vendor "Simon Pamies" for product "Pywebdav"				0.5.1 Search vendor "Simon Pamies" for product "Pywebdav" and version "0.5.1"		-		Affected
Simon Pamies Search vendor "Simon Pamies"		Pywebdav Search vendor "Simon Pamies" for product "Pywebdav"				0.6 Search vendor "Simon Pamies" for product "Pywebdav" and version "0.6"		-		Affected
Simon Pamies Search vendor "Simon Pamies"		Pywebdav Search vendor "Simon Pamies" for product "Pywebdav"				0.7 Search vendor "Simon Pamies" for product "Pywebdav" and version "0.7"		-		Affected
Simon Pamies Search vendor "Simon Pamies"		Pywebdav Search vendor "Simon Pamies" for product "Pywebdav"				0.8 Search vendor "Simon Pamies" for product "Pywebdav" and version "0.8"		-		Affected
Simon Pamies Search vendor "Simon Pamies"		Pywebdav Search vendor "Simon Pamies" for product "Pywebdav"				0.9.1 Search vendor "Simon Pamies" for product "Pywebdav" and version "0.9.1"		-		Affected
Simon Pamies Search vendor "Simon Pamies"		Pywebdav Search vendor "Simon Pamies" for product "Pywebdav"				0.9.2 Search vendor "Simon Pamies" for product "Pywebdav" and version "0.9.2"		-		Affected
Simon Pamies Search vendor "Simon Pamies"		Pywebdav Search vendor "Simon Pamies" for product "Pywebdav"				0.9.3 Search vendor "Simon Pamies" for product "Pywebdav" and version "0.9.3"		-		Affected