A newly disclosed flaw in FTS3 Web Monitoring, versions 3.12.0 through 3.14.0, lets remote attackers inject SQL commands into the /linkinfo endpoint without needing to log in. By manipulating the source_se and dest_se parameters, an attacker can blindly extract data from the database, including stored cloud storage credentials and client secrets for token providers. Operators running affected versions should patch or restrict access to the endpoint immediately.
// source: nvd.nist.gov ↗