CVE-2022-39312

🗓️ 25 Oct 2022 00:00:00Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 109 Views🌐 WEB

Dataease 1.15.2 deserialization vulnerability allows remote attackers to execute system commands

Reporter	Title	Published	Views	Family All 15
CNNVD	DataEase 代码问题漏洞	25 Oct 202200:00	–	cnnvd
Cvelist	CVE-2022-39312 Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability	25 Oct 202200:00	–	cvelist
EUVD	EUVD-2022-7150	3 Oct 202520:07	–	euvd
Github Security Blog	MySQL JDBC deserialization vulnerability	18 Oct 202218:05	–	github
Mend	CVE-2022-39312	25 Oct 202200:00	–	mend
NVD	CVE-2022-39312	25 Oct 202217:15	–	nvd
osv_ghsa	GHSA-Q4QQ-JHJV-7RH2 MySQL JDBC deserialization vulnerability	18 Oct 202218:05	–	osv_ghsa
Prion	Deserialization of untrusted data	25 Oct 202217:15	–	prion
Positive Technologies	PT-2022-24894	18 Oct 202200:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2022-39312: Improper Input Validation	25 Oct 202200:00	–	rapid7

NVD

Vulners

Node

dataease dataeaseRange<1.15.2

[
  {
    "vendor": "dataease",
    "product": "dataease",
    "versions": [
      {
        "version": "< 1.15.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/dataease/dataease/security/advisories/GHSA-q4qq-jhjv-7rh2
github	www.github.com/dataease/dataease/commit/956ee2d6c9e81349a60aef435efc046888e10a6d
github	www.github.com/dataease/dataease/pull/3328
github	www.github.com/dataease/dataease/releases/tag/v1.15.2

Parameter	Position	Path	Description	CWE
jdbc_url	request body	/datasource/mysql	The Mysql data source configuration allows users to provide a JDBC URL. Lack of filtering on the JDBC URL parameters allows an attacker to trigger a deserialization vulnerability in the MySQL JDBC driver by connecting to a malicious server.	CWE-20, CWE-502