CVE-2019-11600

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter

published May 13, 2019

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.6th percentile for exploit probability.

CVSS
—
EPSS
80%
Percentile
99.6
In the wild
Unconfirmed
What it is

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.79956 · 99.6th percentile
Published
2019-05-13T19:57Z
EPSS history
Timeline
  • 22 SEP 03:17Z
    EPSS moved 80% → 66%
    epss
  • 06 SEP 03:12Z
    EPSS moved 80% → 66%
    epss
  • 30 AUG 16:01Z
    EPSS moved 66% → 80%
    epss
  • 29 AUG 04:46Z
    EPSS moved 80% → 66%
    epss
  • 13 MAY 19:57Z
    A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter
    cvelistv5