apache virtual-computing-lab CVE-2018-11774 is a vulnerability in Apache Virtual Computing Lab
Published on July 29, 2019

Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.

NVD


Products Associated with CVE-2018-11774

Want to know whenever a new CVE is published for Apache Virtual Computing Lab? stack.watch will email you.

Apache Virtual Computing Lab
 

Affected Versions

Apache VCL Version 2.1 through 2.5 is affected by CVE-2018-11774

Exploit Probability

EPSS
0.46%
Percentile
63.80%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.