CVE-2019-1010191 SQL Injection in marginalia
Attackers can inject arbitrary SQL queries via user-controlled arguments in the marginalia Ruby library, potentially accessing or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-1010191?
CVE-2019-1010191 is a critical SQL injection vulnerability in marginalia, published on 24 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
marginalia < 1.6 is affected by: SQL Injection. The impact is: The impact is a injection of any SQL queries when a user controller argument is added as a component. The component is: Affects users that add a component that is user controller, for instance a parameter or a header. The attack vector is: Hacker inputs a SQL to a vulnerable vector(header, http parameter, etc). The fixed version is: 1.6.
Weakness: CWE-89
Which versions are affected by CVE-2019-1010191?
2 open source packages ship an affected version, including marginalia. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
marginalia RubyGems | All versions | 1.6 |
marginalia RubyGems | All versions | 1.6 |
Products include Marginalia Project Marginalia.
How do I fix CVE-2019-1010191?
Upgrade marginalia to 1.6 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2019-1010191 being exploited?
There is no known exploitation of CVE-2019-1010191 in the wild and no public exploit code.
Sources
Also known as GHSA-hrj5-qp7x-rpg6.