Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

"query" parameter allows SQL injection

Description

The RESTv1 service supports a "query" parameter that can be used for SQL injection. This parameter is mentioned in the docs but should probably be removed anyway since it can be used for injection.

https://docs.opennms.org/opennms/releases/20.0.0/guide-development/guide-development.html#_alarms

Acceptance / Success Criteria

None

Lucidchart Diagrams

Activity

Show:

Seth Leger July 17, 2017 at 8:33 PM

Marking as fixed.

commit 17599d7066efa97482c70aaef712e5780d68d916
commit 7170327dc5f7daa1fd4be5b25bfb43b271ca14cd

Jesse White July 17, 2017 at 8:07 PM

Seth Leger July 13, 2017 at 2:50 AM

PRs have been created for this issue against the foundation branch for the code and foundation-2016 for the docs (since the docs were ported over from the wiki later).

https://github.com/OpenNMS/opennms/pull/1590
https://github.com/OpenNMS/opennms/pull/1591

Fixed

Details

Assignee

Reporter

Components

Sprint

Fix versions

Affects versions

Priority

PagerDuty

Created June 28, 2017 at 3:14 PM
Updated September 7, 2017 at 5:22 PM
Resolved July 17, 2017 at 8:33 PM