{"id":"GHSA-fv4m-5j2c-787r","aliases":["CVE-2017-15367"],"title":"Bacula-web SQL Injection Vulnerabilities","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"CRITICAL","description":"Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.","severity":"critical","score":9.8,"published":"2022-05-14T02:56:39.000Z","modified":"2024-02-20T05:51:22.318Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"bacula-web/bacula-web","sources":[{"name":"OSV · GHSA-fv4m-5j2c-787r","url":"https://osv.dev/vulnerability/GHSA-fv4m-5j2c-787r"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"8.0.0-rc2"}],"type":"ECOSYSTEM"}],"versions":["v8.0.0-rc.1"],"fixed":["8.0.0-rc2"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2017-15367","https://github.com/bacula-web/bacula-web/commit/90d4c44a0dd0d65c6fb3ab2417b83d700c8413ae","https://github.com/bacula-web/bacula-web","https://web.archive.org/web/20180324124226/http://bacula-web.org/download/articles/bacula-web-8-0-0-rc2.html","https://web.archive.org/web/20180625090858/http://bugs.bacula-web.org/view.php?id=211","https://www.exploit-db.com/exploits/44272"],"sources":[{"name":"OSV","id":"GHSA-fv4m-5j2c-787r","modified":"2024-02-20T05:51:22.318005Z","url":"https://osv.dev/vulnerability/GHSA-fv4m-5j2c-787r"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T03:30:33.923Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[{"source":"Exploit-DB","id":"44272","url":"https://www.exploit-db.com/exploits/44272","checkedAt":"2026-10-29T00:00:35.338Z"}]}