https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 29 Aug 2026 21:05:28 +0000 https://vulnerability.circl.lu/sighting/a1537a09-1837-47f3-a431-c83cc48c100b/export {"uuid": "a1537a09-1837-47f3-a431-c83cc48c100b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RXHG-VCWW-2MPW", "type": "seen", "source": "https://gist.github.com/alon710/e119e0e3dc0dc9f08b09963cc2e8d5fb", "content": "# GHSA-RXHG-VCWW-2MPW: GHSA-RXHG-VCWW-2MPW: SQL Injection via ORDER BY Column Injection in Fleet Activity List Endpoints\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-RXHG-VCWW-2MPW\n\n## Summary\nA SQL injection vulnerability exists in the activity list endpoints of Fleet Device Management. Authenticated users can manipulate the order_key parameter to sort database queries by arbitrary columns, including columns not projected in the SELECT query. This flaw allows attackers to establish an inference oracle to extract sensitive information from the database.\n\n## TL;DR\nAn authenticated SQL injection vulnerability in Fleet allows attackers to use the ORDER BY clause on activity endpoints as an inference oracle, enabling character-by-character database exfiltration.\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (Authenticated)\n- **Vulnerability Type**: SQL Injection / Information Disclosure\n- **CVSS v3.1 Score**: 8.1\n- **Exploit Status**: None / Theoretical\n- **KEV Status**: Not Listed\n- **Affected Component**: Activity List Endpoints\n\n## Affected Systems\n\n- Fleet Device Management Platform\n- **Fleet**: < 4.89.1 (Fixed in: `4.89.1`)\n\n## Mitigation\n\n- Upgrade Fleet server to version 4.89.1, 4.90.0, or subsequent releases.\n- Deploy WAF rules to validate and restrict the character set of the order_key query parameter on activity feeds.\n- Implement audit logging on MySQL and Fleet API requests to monitor for anomalous sorting strings.\n\n**Remediation Steps:**\n1. Identify all deployed instances of the Fleet server.\n2. Pull the updated Docker image or binary for version 4.90.0 or 4.89.1.\n3. Apply the updated container/binary to the production environment.\n4. Run automated validation tests to confirm that sending arbitrary order_key values yields a 422 Unprocessable Entity status code.\n\n## References\n\n- [GitHub Security Advisory GHSA-RXHG-VCWW-2MPW](https://github.com/advisories/GHSA-RXHG-VCWW-2MPW)\n- [FleetDM Pull Request #49624](https://github.com/fleetdm/fleet/pull/49624)\n- [FleetDM Legacy Cleanup Pull Request #44385](https://github.com/fleetdm/fleet/pull/44385)\n- [FleetDM Validation Pull Request #51556](https://github.com/fleetdm/fleet/pull/51556)\n- [Fleet Release v4.89.0](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.89.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-RXHG-VCWW-2MPW) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T15:31:46.367655Z"} {"uuid": "a1537a09-1837-47f3-a431-c83cc48c100b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RXHG-VCWW-2MPW", "type": "seen", "source": "https://gist.github.com/alon710/e119e0e3dc0dc9f08b09963cc2e8d5fb", "content": "# GHSA-RXHG-VCWW-2MPW: GHSA-RXHG-VCWW-2MPW: SQL Injection via ORDER BY Column Injection in Fleet Activity List Endpoints\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-RXHG-VCWW-2MPW\n\n## Summary\nA SQL injection vulnerability exists in the activity list endpoints of Fleet Device Management. Authenticated users can manipulate the order_key parameter to sort database queries by arbitrary columns, including columns not projected in the SELECT query. This flaw allows attackers to establish an inference oracle to extract sensitive information from the database.\n\n## TL;DR\nAn authenticated SQL injection vulnerability in Fleet allows attackers to use the ORDER BY clause on activity endpoints as an inference oracle, enabling character-by-character database exfiltration.\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (Authenticated)\n- **Vulnerability Type**: SQL Injection / Information Disclosure\n- **CVSS v3.1 Score**: 8.1\n- **Exploit Status**: None / Theoretical\n- **KEV Status**: Not Listed\n- **Affected Component**: Activity List Endpoints\n\n## Affected Systems\n\n- Fleet Device Management Platform\n- **Fleet**: < 4.89.1 (Fixed in: `4.89.1`)\n\n## Mitigation\n\n- Upgrade Fleet server to version 4.89.1, 4.90.0, or subsequent releases.\n- Deploy WAF rules to validate and restrict the character set of the order_key query parameter on activity feeds.\n- Implement audit logging on MySQL and Fleet API requests to monitor for anomalous sorting strings.\n\n**Remediation Steps:**\n1. Identify all deployed instances of the Fleet server.\n2. Pull the updated Docker image or binary for version 4.90.0 or 4.89.1.\n3. Apply the updated container/binary to the production environment.\n4. Run automated validation tests to confirm that sending arbitrary order_key values yields a 422 Unprocessable Entity status code.\n\n## References\n\n- [GitHub Security Advisory GHSA-RXHG-VCWW-2MPW](https://github.com/advisories/GHSA-RXHG-VCWW-2MPW)\n- [FleetDM Pull Request #49624](https://github.com/fleetdm/fleet/pull/49624)\n- [FleetDM Legacy Cleanup Pull Request #44385](https://github.com/fleetdm/fleet/pull/44385)\n- [FleetDM Validation Pull Request #51556](https://github.com/fleetdm/fleet/pull/51556)\n- [Fleet Release v4.89.0](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.89.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-RXHG-VCWW-2MPW) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T15:31:46.367655Z"} https://vulnerability.circl.lu/sighting/a1537a09-1837-47f3-a431-c83cc48c100b/export Fri, 21 Aug 2026 15:31:46 +0000