Read the docs
TI-2011-00394 Aliases CVE-2011-0467GHSA-949h-c8q7-ffm5

SQL injection in SUSE studio via select parameter

Priority MEDIUM 41CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

A vulnerability in the listing of available software of SUSE Studio Onsite, SUSE Studio Onsite 1.1 Appliance allows authenticated users to execute arbitrary SQL statements via SQL injection. Affected releases are SUSE Studio Onsite: versions prior to 1.0.3-0.18.1, SUSE Studio Onsite 1.1 Appliance: versions prior to 1.1.2-0.25.1.

Why it matters now

EPSS 0.0129 70th percentileScored 2026-11-07
Fix Fixed SUSE Studio Onsite (SUSE): 1.0.3-0.18.1SUSE Studio Onsite 1.1 Appliance (SUSE): 1.1.2-0.25.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE Studio Onsitebefore 1.0.3-0.18.11.0.3-0.18.1Patch availableCNA
SUSESUSE Studio Onsite 1.1 Appliancebefore 1.1.2-0.25.11.1.2-0.25.1Patch availableCNA
  • SUSE Studio Onsite VendorSUSE Affected before 1.0.3-0.18.1 Fixed in 1.0.3-0.18.1 Patch available CNA
  • SUSE Studio Onsite 1.1 Appliance VendorSUSE Affected before 1.1.2-0.25.1 Fixed in 1.1.2-0.25.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:suse:studio_onsite:*:*:*:*:*:*:*:*before 1.0.3-0.18.1VulnerableSUSE
cpe:2.3:a:suse:studio_onsite_appliance:*:*:*:*:*:*:*:*before 1.1.2-0.25.1VulnerableSUSE
  • cpe:2.3:a:suse:studio_onsite:*:*:*:*:*:*:*:* Versions before 1.0.3-0.18.1 Vulnerable ·SUSE
  • cpe:2.3:a:suse:studio_onsite_appliance:*:*:*:*:*:*:*:* Versions before 1.1.2-0.25.1 Vulnerable ·SUSE

Remediation

  • Fix · CNA SUSE Studio Onsite (SUSE) Fixed in 1.0.3-0.18.1
  • Fix · CNA SUSE Studio Onsite 1.1 Appliance (SUSE) Fixed in 1.1.2-0.25.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-0467
  2. 2026-10-03 Alias added: GHSA-949h-c8q7-ffm5

References

Other 2

  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-04424 The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows… CVSS 3.1CRITICAL 9.8
  • TI-2013-03992 nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass… CVSS 2.0HIGH 7.5
  • TI-2016-00645 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly… CVSS 3.1CRITICAL 9.8
  • TI-2014-08019 Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9… CVSS 3.0CRITICAL 9.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences