CVE-2019-7548 | SynScan

Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2019-7548

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

Published: Feb 6, 2019
Updated: May 9, 2024
CVE: CVE-2019-7548
GHSA: GHSA-38fc-9xqv-7f7q
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.8
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-89

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
sqlalchemy / sqlalchemy	1.2.17	1.2.17.x
debian / debian_linux	8.0	8.0.x
debian / debian_linux	9.0	9.0.x
opensuse / leap	15.0	15.0.x
opensuse / leap	15.1	15.1.x
opensuse / backports_sle	15.0	15.0.x
redhat / enterprise_linux_eus	8.1	8.1.x
redhat / enterprise_linux_eus	8.2	8.2.x
redhat / enterprise_linux_server_tus	8.2	8.2.x
redhat / enterprise_linux_server_aus	8.2	8.2.x
redhat / enterprise_linux	8.0	8.0.x
redhat / enterprise_linux_server_tus	8.4	8.4.x
redhat / enterprise_linux_eus	8.4	8.4.x
redhat / enterprise_linux_server_aus	8.4	8.4.x
oracle / communications_operations_monitor	4.2	4.2.x
oracle / communications_operations_monitor	4.3	4.3.x
SQLAlchemy	-	1.3.0