SQL Injection Vulnerability in Apache VCL Versions 2.1 to 2.5

CVE-2018-11774

What is CVE-2018-11774?

Apache VCL versions 2.1 through 2.5 have a security flaw involving improper validation of form inputs during the addition and removal of virtual machines (VMs) from hosts. This weakness can lead to SQL injection attacks, as maliciously crafted input can be executed in SQL statements. Though access to this component of the VCL system requires administrative privileges, which offers a layer of security, systems running versions earlier than 2.5.1 should be promptly upgraded or patched to eliminate this risk.

References