Bacula-web SQL Injection Vulnerabilities

CRITICAL 9.8CVE-2017-15367 · GHSA-fv4m-5j2c-787r · Published 07/03/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
bacula-web/bacula-web Packagist	`< 8.0.0-rc2`	`8.0.0-rc2`
bacula-web bacula	`= 8.0.0≤ 7.4.0`	No fix yet

Description

Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-15367 · ADVISORY
bacula-web/bacula-web commit 90d4c44 · WEB
bacula-web/bacula-web · PACKAGE
web.archive.org/web/20180324124226/http://bacula-web.org/download/articles/bacula-web-8-0-0-rc2.html · WEB
web.archive.org/web/20180625090858/http://bugs.bacula-web.org/view.php · WEB
exploit-db.com/exploits/44272 · WEB
bacula-web.org/download/articles/bacula-web-8-0-0-rc2.html · Release Notes
bugs.bacula-web.org/view.php · Issue Tracking
exploit-db.com/exploits/44272 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free