Unscored severity · published Jun 5, 2012
CVE-2012-0805
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset…
–
CVSS
2.9%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Sqlalchemy · Sqlalchemy
through 0.7.0; 0.6.0; 0.6.0; 0.6.0; 0.6.0; 0.6.1; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0805
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0805
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-0369.html
Vendor Advisory
http://secunia.com/advisories/48327
Vendor Advisory
http://secunia.com/advisories/48328
Vendor Advisory
http://secunia.com/advisories/48771
www.debian.org
http://www.debian.org/security/2012/dsa-2449
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2012:059
More from Sqlalchemy
9.8
CVE-2019-7164
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter
7.8
CVE-2019-7548
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled