CVE-2022-1848: Business Logic Errors in Para
Summary
CVE-2022-1848: Business Logic Errors in Para. Affects com.erudika:para-core versions < 1.46.0. Fixed in 1.46.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Para is a package in the Maven ecosystem that provides functionality for creating and managing apps. It is used by developers to build applications with user authentication, data storage, and other features. However, prior to version 1.46.0, Para is vulnerable to business logic errors. This vulnerability allows a user to create more than one app, even after reaching the app limit set by the system.
Vulnerability Detail
The vulnerability in Para arises from a flaw in its app creation logic. By exploiting this flaw, a user can bypass the app limit and create multiple apps, potentially leading to resource exhaustion and abuse of system resources. This can impact the stability and performance of the application. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.46.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update Para to the fixed version to mitigate the risk.
Conclusion
In conclusion, Para prior to version 1.46.0 is vulnerable to business logic errors that allow users to create more apps than allowed. This can lead to resource exhaustion and abuse of system resources. To mitigate the risk, it is crucial to update Para to version 1.46.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.erudika:para-core →
FAQ
Para is a package in the Maven ecosystem that provides functionality for creating and managing apps.
The vulnerability allows users to create more apps than allowed, potentially leading to resource exhaustion and abuse of system resources.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
To fix this vulnerability, update Para to version 1.46.0 or later.
No, there is no known workaround. Updating to the fixed version is necessary.
Related vulnerabilities
Recent vulnerabilities recorded for com.erudika:para-core.
