SQL Injection Affecting pywebdav package, versions [,0.9.4.1)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.39% (75th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about SQL Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PYTHON-PYWEBDAV-40057
  • published26 Feb 2016
  • disclosed14 Mar 2011
  • creditUnknown

Introduced: 14 Mar 2011

CVE-2011-0432  (opens in a new tab)
CWE-89  (opens in a new tab)

Overview

pywebdav is a WebDAV library including a standalone server for python Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.

CVSS Scores

version 3.1