CVE-2022-41828

🗓️ 29 Sep 2022 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 87 Views🌐 WEB

Amazon Redshift JDBC Driver Object Factory Class Type Check Bypas

Reporter	Title	Published	Views	Family All 15
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by a redshift-jdbc42-2.0.0.3.jar vulnerability (CVE-2022-41828)	2 Mar 202315:04	–	ibm
Circl	CVE-2022-41828	30 Sep 202200:35	–	circl
CNNVD	Amazon AWS Redshift JDBC Driver 代码问题漏洞	29 Sep 202200:00	–	cnnvd
Cvelist	CVE-2022-41828	29 Sep 202200:00	–	cvelist
GithubExploit	Exploit for Incorrect Type Conversion or Cast in Amazon Amazon_Web_Services_Redshift_Java_Database_Connectivity_Driver	9 Dec 202210:35	–	githubexploit
Github Security Blog	Duplicate Advisory: AWS Redshift JDBC Driver fails to validate class type during object instantiation	30 Sep 202200:00	–	github
Github Security Blog	com.amazon.redshift:redshift-jdbc42 vulnerable to remote command execution	12 Oct 202218:23	–	github
NVD	CVE-2022-41828	29 Sep 202221:15	–	nvd
OSV	GHSA-5C6Q-F783-H888 Duplicate Advisory: AWS Redshift JDBC Driver fails to validate class type during object instantiation	30 Sep 202200:00	–	osv
OSV	GHSA-JC69-HJW2-FM86 com.amazon.redshift:redshift-jdbc42 vulnerable to remote command execution	12 Oct 202218:23	–	osv

NVD

Node

Source	Link
github	www.github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-jc69-hjw2-fm86
github	www.github.com/aws/amazon-redshift-jdbc-driver/commit/40b143b4698faf90c788ffa89f2d4d8d2ad068b5

Parameter	Position	Path	Description	CWE
jdbc	request body	/jdbcset	Vulnerable endpoint invoking DriverManager.getConnection with a crafted JDBC URL enabling remote code execution via crafted socketFactory payload.	CWE-704

20 May 2025 20:15Current

7.9High risk

Vulners AI Score7.9

CVSS 3.18.1 - 8.8

EPSS0.09641

SSVC