apache virtual-computing-lab CVE-2018-11772 is a vulnerability in Apache Virtual Computing Lab
Published on July 29, 2019

Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.

NVD


Products Associated with CVE-2018-11772

Want to know whenever a new CVE is published for Apache Virtual Computing Lab? stack.watch will email you.

Apache Virtual Computing Lab
 

Affected Versions

Apache VCL Version 2.1 through 2.5 is affected by CVE-2018-11772

Exploit Probability

EPSS
0.46%
Percentile
63.80%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.