CVE-2016-3072

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-07 · updated 2026-06-17
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter.

Affected products

Katello: all versions
Red Hat Satellite 6: 6.1

References

https://access.redhat.com/errata/RHSA-2016:1083
https://bugzilla.redhat.com/show_bug.cgi?id=1322050
https://github.com/Katello/katello/pull/6051
https://access.redhat.com/errata/RHSA-2016:1083
https://bugzilla.redhat.com/show_bug.cgi?id=1322050
https://github.com/Katello/katello/pull/6051

Get alerted when CVE-2016-3072 or the next vulnerability affects your stack