CVE-2020-35545

NameCVE-2020-35545
DescriptionTime-based SQL injection exists in Spotweb 1.4.9 via the query string.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh
Debian Bugs977719

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
spotweb (PTS)buster, stretch20130826+dfsg3-4vulnerable
bullseye, sid20130826+dfsg3-4.1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
spotwebsource(unstable)(unfixed)977719

Notes

[buster] - spotweb <no-dsa> (Minor issue)
https://github.com/spotweb/spotweb/issues/629
https://github.com/spotweb/spotweb/commit/fefb39ad143caad021ad496427617db79c42aff2

Search for package or bug name: Reporting problems