CVE-2022-34115: SQL Injection in Dataease v1.11.1 via parameter dataSourceId
Summary
CVE-2022-34115: Dataease v1.11.1 SQL Injection via parameter dataSourceId. Affects io.dataease:dataease-plugin-common versions < 1.11.2. Fixed in 1.11.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dataease v1.11.1 is an open-source software package that provides various functionalities for data management. It is commonly used in Maven projects. The package 'io.dataease:dataease-plugin-common' is particularly affected by a SQL injection vulnerability.
Vulnerability Detail
The SQL injection vulnerability in Dataease v1.11.1 arises from improper handling of the 'dataSourceId' parameter. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, data manipulation, or even remote code execution. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.11.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version.
Conclusion
Dataease v1.11.1 is vulnerable to a critical SQL injection vulnerability. It is crucial to update to version 1.11.2 or later to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for io.dataease:dataease-plugin-common →
FAQ
The vulnerability allows attackers to execute arbitrary SQL queries, potentially leading to unauthorized data access, data manipulation, or remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file to analyze the dependencies.
No, there is no known workaround for this vulnerability. It is crucial to update to the fixed version.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-vjmr-6pmm-rprf/GHSA-vjmr-6pmm-rprf.json
Related vulnerabilities
Recent vulnerabilities recorded for io.dataease:dataease-plugin-common.
