Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-mfzd-r5pm-q7es
Summarysilverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector
Aliases
0
alias GHSA-265q-222x-52m6
Fixed_packages
0
url pkg:composer/silverstripe/framework@4.0.6
purl pkg:composer/silverstripe/framework@4.0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3497-71mw-yqh8
1
vulnerability VCID-4mg2-rjsn-qyfx
2
vulnerability VCID-7kmy-8ht6-8fcw
3
vulnerability VCID-9vwe-uejx-c3c5
4
vulnerability VCID-jc9t-3hb5-z3g5
5
vulnerability VCID-m2bw-tabk-qyd8
6
vulnerability VCID-x6g5-a61e-3khu
7
vulnerability VCID-yxg1-dz91-ckgs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.6
1
url pkg:composer/silverstripe/framework@4.1.4
purl pkg:composer/silverstripe/framework@4.1.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3497-71mw-yqh8
1
vulnerability VCID-4mg2-rjsn-qyfx
2
vulnerability VCID-7kmy-8ht6-8fcw
3
vulnerability VCID-8bkg-xn4y-nydr
4
vulnerability VCID-9vwe-uejx-c3c5
5
vulnerability VCID-jc9t-3hb5-z3g5
6
vulnerability VCID-m2bw-tabk-qyd8
7
vulnerability VCID-x6g5-a61e-3khu
8
vulnerability VCID-yxg1-dz91-ckgs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.1.4
2
url pkg:composer/silverstripe/framework@4.2.3
purl pkg:composer/silverstripe/framework@4.2.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3497-71mw-yqh8
1
vulnerability VCID-4mg2-rjsn-qyfx
2
vulnerability VCID-7kmy-8ht6-8fcw
3
vulnerability VCID-8bkg-xn4y-nydr
4
vulnerability VCID-9vwe-uejx-c3c5
5
vulnerability VCID-jc9t-3hb5-z3g5
6
vulnerability VCID-m2bw-tabk-qyd8
7
vulnerability VCID-x6g5-a61e-3khu
8
vulnerability VCID-yxg1-dz91-ckgs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.2.3
Affected_packages
0
url pkg:composer/silverstripe/framework@4.0.0-rc1
purl pkg:composer/silverstripe/framework@4.0.0-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-25r7-spjd-qufz
1
vulnerability VCID-2e1q-fc4b-mydq
2
vulnerability VCID-2p3r-ff36-aqfm
3
vulnerability VCID-4mg2-rjsn-qyfx
4
vulnerability VCID-6zn9-kt2q-s3bq
5
vulnerability VCID-7kmy-8ht6-8fcw
6
vulnerability VCID-9vwe-uejx-c3c5
7
vulnerability VCID-c3aa-8je2-quek
8
vulnerability VCID-hp6e-75gr-uuan
9
vulnerability VCID-hsfb-xx67-7qg6
10
vulnerability VCID-jxym-rkhj-yybr
11
vulnerability VCID-k1aa-deyg-2kdg
12
vulnerability VCID-k6ed-y2ud-wffu
13
vulnerability VCID-k8vz-xw7w-e3dg
14
vulnerability VCID-m2bw-tabk-qyd8
15
vulnerability VCID-mfzd-r5pm-q7es
16
vulnerability VCID-pmb3-k9w1-y7gm
17
vulnerability VCID-s99v-qdmh-ebf8
18
vulnerability VCID-x6g5-a61e-3khu
19
vulnerability VCID-yxg1-dz91-ckgs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.0-rc1
1
url pkg:composer/silverstripe/framework@4.1.0-rc1
purl pkg:composer/silverstripe/framework@4.1.0-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-25r7-spjd-qufz
1
vulnerability VCID-2e1q-fc4b-mydq
2
vulnerability VCID-2p3r-ff36-aqfm
3
vulnerability VCID-4mg2-rjsn-qyfx
4
vulnerability VCID-6zn9-kt2q-s3bq
5
vulnerability VCID-7kmy-8ht6-8fcw
6
vulnerability VCID-8z35-2baj-cqdb
7
vulnerability VCID-9vwe-uejx-c3c5
8
vulnerability VCID-9wms-djy3-x7fs
9
vulnerability VCID-c3aa-8je2-quek
10
vulnerability VCID-fgmy-q8sf-n3dj
11
vulnerability VCID-jc9t-3hb5-z3g5
12
vulnerability VCID-jxym-rkhj-yybr
13
vulnerability VCID-m2bw-tabk-qyd8
14
vulnerability VCID-mfzd-r5pm-q7es
15
vulnerability VCID-pmb3-k9w1-y7gm
16
vulnerability VCID-x6g5-a61e-3khu
17
vulnerability VCID-yxg1-dz91-ckgs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.1.0-rc1
2
url pkg:composer/silverstripe/framework@4.2.0-rc1
purl pkg:composer/silverstripe/framework@4.2.0-rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6zn9-kt2q-s3bq
1
vulnerability VCID-jxym-rkhj-yybr
2
vulnerability VCID-mfzd-r5pm-q7es
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.2.0-rc1
References
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-020-1.yaml
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-020-1.yaml
1
reference_url https://github.com/silverstripe/silverstripe-framework
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework
2
reference_url https://github.com/silverstripe/silverstripe-framework/commit/48bd335648188df9dae72be1e5f9c808f3fe1e77
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/48bd335648188df9dae72be1e5f9c808f3fe1e77
3
reference_url https://github.com/silverstripe/silverstripe-framework/commit/fecedc2d98eeaaff6424fb59dc70ef6bdc6dc92d
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/silverstripe/silverstripe-framework/commit/fecedc2d98eeaaff6424fb59dc70ef6bdc6dc92d
4
reference_url https://www.silverstripe.org/download/security-releases/ss-2018-020
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.silverstripe.org/download/security-releases/ss-2018-020
5
reference_url https://github.com/advisories/GHSA-265q-222x-52m6
reference_id GHSA-265q-222x-52m6
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-265q-222x-52m6
Weaknesses
0
cwe_id 89
name Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score7.0 - 8.9
Exploitability0.5
Weighted_severity8.0
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-mfzd-r5pm-q7es