CVE-2026-34385
Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database
概要
Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user credentials, API tokens, and device enrollment secrets. Version 4.81.0 patches the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov