CVE-2022-45801: falha em Apache StreamPark (incubating)
Apache StreamPark (incubating): LDAP Injection Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 1.1%
Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability.
LDAP Injection is an attack used to exploit web based applications
that construct LDAP statements based on user input. When an
application fails to properly sanitize user input, it's possible to
modify LDAP statements through techniques similar to SQL Injection.
LDAP injection attacks could result in the granting of permissions to
unauthorized queries, and content modification inside the LDAP tree.
This risk may only occur when the user logs in with ldap, and the user
name and password login will not be affected, Users of the affected
versions should upgrade to Apache StreamPark 2.0.0 or later.
Produtos afetados
Apache Software Foundation · Apache StreamPark (incubating)CVEs relacionadas — Apache StreamPark (incubating)
No mesmo produto, das mais perigosas para as menos.
CVE-2023-49898—Apache StreamPark (incubating): Authenticated system users could trigger remote command executionEPSS 2.3%CVE-2023-52291HIGHApache StreamPark (incubating): Unchecked maven build params could trigger remote command executionEPSS 1.6%CVE-2022-46365CRITICALApache StreamPark (incubating): Logic error causing any account resetEPSS 1.5%CVE-2022-45802CRITICALApache StreamPark (incubating): Upload any file to any directoryEPSS 1.3%CVE-2024-29737HIGHApache StreamPark (incubating): maven build params could trigger remote command executionEPSS 1.1%CVE-2023-30867—Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerabilityEPSS 0.9%