CVE-2011-0432
PyWebDAV SQL Injection vulnerability
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.
- Record
CVE-2011-0432- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.
- Record
CVE-2011-0432- Updated
- 2026-11-02
EUVDEUVD-2011-0024 No score
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.
- Record
EUVD-2011-0024- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-69vw-jfq7-935g
PyWebDAV SQL Injection vulnerability
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.
- Record
GHSA-69vw-jfq7-935g- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-69vw-jfq7-935g
PyWebDAV SQL Injection vulnerability
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.
- Record
GHSA-69vw-jfq7-935g- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV No score
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.
- Record
CVE-2011-0432- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-0432 No score
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.
- Record
DEBIAN-CVE-2011-0432- Updated
- 2026-11-02
OSVPYSEC-2011-7 No score
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.
- Record
PYSEC-2011-7- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pywebdavPyPI |
before 0.9.4.1 | 0.9.4.1 |
pywebdavDebian:12 |
before 0.9.4-3 | 0.9.4-3 |
pywebdavDebian:13 |
before 0.9.4-3 | 0.9.4-3 |
pywebdavDebian:14 |
before 0.9.4-3 | 0.9.4-3 |
pywebdavDebian:6.0 |
before 0.9.4-1+squeeze1, plus listed versions 0.9.4-1 |
0.9.4-1+squeeze1 |
pywebdavPyPI |
before 0.9.4.1, plus listed versions 0.60.70.80.90.9.10.9.20.9.30.9.4 |
0.9.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0432 is a high vulnerability (CVSS 7.5) in Simon Pamies Pywebdav, published March 2, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.81%, the 78th percentile. Fixed in pywebdav 0.9.4.1.
References
debian.org/security/2011/dsa-2177
lists.fedoraproject.org/pipermail/package-announce/2011-March/055444.html
pywebdav.googlecode.com/files/PyWebDAV-0.9.4.1.tar.gz
secunia.com/advisories/43602
vupen.com/english/advisories/2011/0553
Show 17 moreShow less
securityfocus.com/bid/46655
code.google.com/p/pywebdav/updates/list
bugzilla.redhat.com/show_bug.cgi?id=677718
nvd.nist.gov/vuln/detail/CVE-2011-0432
web.archive.org/web/20110305233800/http://secunia.com/advisories/43571
github.com/pypa/advisory-database/tree/main/vulns/pywebdav/PYSEC-2011-7.yaml
security-tracker.debian.org/tracker/CVE-2011-0432