CVE-2020-15886: MunkiReport reportdata module SQL injection vulnerability
Summary
CVE-2020-15886: MunkiReport reportdata module SQL injection vulnerability. Affects munkireport/reportdata versions < 3.5. Fixed in 3.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MunkiReport is a package that provides a reporting framework for Munki, an open-source software deployment and management tool for macOS. The reportdata module is a component of MunkiReport that allows users to generate reports based on collected data. However, a SQL injection vulnerability has been discovered in the reportdata_controller.php file of the reportdata module before version 3.5. This vulnerability enables attackers to execute arbitrary SQL commands by exploiting the 'req' parameter of the '/module/reportdata/ip' endpoint.
Vulnerability Detail
The SQL injection vulnerability in the MunkiReport reportdata module poses a significant security risk. By manipulating the 'req' parameter, attackers can inject malicious SQL commands into the application's database. This can lead to unauthorized access, data leakage, data manipulation, or even complete compromise of the system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
3.5
This is the first release that contains the fix.
composer require munkireport/reportdata:3.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the reportdata module.
Conclusion
The SQL injection vulnerability in the MunkiReport reportdata module is a critical security issue that can have severe consequences. It is crucial for users to upgrade to version 3.5 or later of the reportdata module to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for munkireport/reportdata →
FAQ
MunkiReport is a reporting framework for Munki, a macOS software deployment and management tool.
The reportdata module is a component of MunkiReport that allows users to generate reports based on collected data.
SQL injection is a web security vulnerability that allows an attacker to manipulate SQL queries to execute arbitrary commands on a database.
This vulnerability can lead to unauthorized access, data leakage, data manipulation, or even complete compromise of the system.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
