Strix
26.1K

CVE-2019-12149

UnknownEPSS 1.35%

Last modified

CVE-2019-12149 is a vulnerability of currently unknown severity. SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry module 2.1.x before 2.1.1 and 2.2.x before 2.2.1 allows attackers to execute arbitrary SQL commands.. EPSS estimates a 1.35% chance of exploitation in the next 30 days.

Description

SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry module 2.1.x before 2.1.1 and 2.2.x before 2.2.1 allows attackers to execute arbitrary SQL commands.

Metrics

EPSS Probability
1.35%

68.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
SilverstripeRegistry>= 2.1.0, < 2.1.1
SilverstripeRegistry>= 2.2.0, < 2.2.1
SilverstripeRestfulserver>= 1.0.1, < 1.0.9
SilverstripeRestfulserver>= 2.0.0, < 2.0.4

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-12149?
SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry module 2.1.x before 2.1.1 and 2.2.x before 2.2.1 allows attackers to execute arbitrary SQL commands.
How severe is CVE-2019-12149?
Severity scoring for CVE-2019-12149 is pending analysis. The EPSS model estimates a 1.35% probability of exploitation in the next 30 days.
How do I fix CVE-2019-12149?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-12149?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST