{"id":"CVE-2025-71458","title":"FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo","summary":"FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_s…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-89"],"vendor":"cern-fts","product":"fts-monitoring","affected":["fts-monitoring >= 3.12.0 < 3.13.3","fts-monitoring >= 3.14.0 < 3.14.1"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T00:20:23.644Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71458","references":[{"url":"https://advisories.egi.eu/Advisory-EGI-SVG-2025-09","label":"EGI SVG Advisory EGI-SVG-2025-09"},{"url":"https://github.com/cern-fts/fts-monitoring/commit/e993c27d60a150c67cc2b415ddb272b5d3f05596","label":"Patch Commit"},{"url":"https://github.com/cern-fts/fts-monitoring/commit/96241f6e9911195aae8e9e07bce511da4e81fc08","label":"Backport Commit (3.13.3)"},{"url":"https://github.com/cern-fts/fts-monitoring/blob/v3.14.0/src/apps/ftsmon/views/linkinfo.py#L27-L60","label":"Vulnerable get_linkinfo at v3.14.0"},{"url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.14.1","label":"fts-monitoring v3.14.1 Release Notes"},{"url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.13.3","label":"fts-monitoring v3.13.3 Release Notes"},{"url":"https://github.com/cern-fts/fts-monitoring"},{"url":"https://www.vulncheck.com/advisories/fts3-web-monitoring-3.12.0-through-3.13.2-and-3.14.0-sql-injection-via-linkinfo","label":"VulnCheck Advisory: FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T00:42:24.725Z","epss":0.00395,"epssPercentile":0.33979,"slug":"CVE-2025-71458","body":"## Overview\n\nFTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.\n\n## Affected\n\n- `fts-monitoring >= 3.12.0 < 3.13.3`\n- `fts-monitoring >= 3.14.0 < 3.14.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}