CVE-2011-0432

PyWebDAV < 0.9.4.1 - SQL Injection via User or Password Argument

Title source: llm
STIX 2.1

Description

Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.

References (14)

Core 14
Core References
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2011/dsa-2177
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055444.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43602
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43571
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0553
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055413.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055412.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43703
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0554
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0634
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/46655
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=677718

Scores

EPSS 0.0180
EPSS Percentile 76.1%

Details

CWE
CWE-89
Status published
Products (11)
pypi/pywebdav 0 - 0.9.4.1PyPI
simon_pamies/pywebdav 0.3
simon_pamies/pywebdav 0.5
simon_pamies/pywebdav 0.5.1
simon_pamies/pywebdav 0.6
simon_pamies/pywebdav 0.7
simon_pamies/pywebdav 0.8
simon_pamies/pywebdav 0.9.1
simon_pamies/pywebdav 0.9.2
simon_pamies/pywebdav 0.9.3
... and 1 more
Published Mar 14, 2011
Tracked Since Feb 18, 2026