CVE-2020-35545

NameCVE-2020-35545
DescriptionTime-based SQL injection exists in Spotweb 1.4.9 via the query string.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh
Debian Bugs977719

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
spotweb (PTS)buster, stretch20130826+dfsg3-4vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
spotwebsource(unstable)(unfixed)977719

Notes

[buster] - spotweb <no-dsa> (Minor issue)
[stretch] - spotweb <no-dsa> (Minor issue)
https://github.com/spotweb/spotweb/issues/629
https://github.com/spotweb/spotweb/commit/fefb39ad143caad021ad496427617db79c42aff2
https://github.com/spotweb/spotweb/commit/25c1f89f0202af5d5d224b906ff9d9313f017aa6
When fixing the issue make sure to apply the complete fix for CVE-2020-35545
and not open CVE-2021-3286. Cf.
https://github.com/spotweb/spotweb/issues/653

Search for package or bug name: Reporting problems