CVE-2022-31764highCWE-913

CVE-2022-31764: falha de alta gravidade em Apache ShardingSphere ElasticJob-UI

Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC

Publicada em

Seguir esta CVE+ Monitorar Apache ShardingSphere ElasticJob-UI

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.5epss 0.7%
The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of this attack is that the attacker has obtained the account and password. Otherwise, the attacker cannot perform this attack.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache ShardingSphere ElasticJob-UI
CVEs relacionadas — Apache ShardingSphere ElasticJob-UI

No mesmo produto, das mais perigosas para as menos.

CVE-2022-22733—Access-Token in ElasticJob UI causes password disclosureEPSS 37.6%