CVE-2024-35181

🗓️ 27 May 2024 18:18:37Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 90 Views🌐 WEB

SQL injection vulnerability in Meshery 0.7.22

Reporter	Title	Published	Views	Family All 12
CNNVD	Meshery 安全漏洞	27 May 202400:00	–	cnnvd
Cvelist	CVE-2024-35181 GHSL-2024-013 Meshery SQL Injection vulnerability	27 May 202418:18	–	cvelist
EUVD	EUVD-2024-2546	3 Oct 202520:07	–	euvd
Github Security Blog	Meshery SQL Injection vulnerability	5 Aug 202421:29	–	github
NVD	CVE-2024-35181	27 May 202419:15	–	nvd
OSV	CVE-2024-35181 GHSL-2024-013 Meshery SQL Injection vulnerability	27 May 202418:18	–	osv
OSV	GHSA-9F24-JRV4-F8G5 Meshery SQL Injection vulnerability	5 Aug 202421:29	–	osv
OSV	GO-2024-3050 Meshery SQL Injection vulnerability in github.com/layer5io/meshery	6 Aug 202422:40	–	osv
Positive Technologies	PT-2024-26362 · Meshery · Meshery	23 May 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-35181	23 May 202509:07	–	redhatcve

NVD

Vulners

Node

layer5 mesheryRange<0.7.22

[
  {
    "vendor": "meshery",
    "product": "meshery",
    "versions": [
      {
        "version": "< 0.7.22",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/meshery/meshery/commit/8e995ce21af02d32ef61689c1e1748a745917f13
securitylab	www.securitylab.github.com/advisories/GHSL-2024-013_GHSL-2024-014_Meshery/
github	www.github.com/meshery/meshery/commit/b55f6064d0c6a965aee38f30281f99da7dc4420c
github	www.github.com/meshery/meshery/pull/10207
github	www.github.com/meshery/meshery/blob/b331f45c9083d7abf6b90105072b04cd22473de7/server/handlers/meshsync_handler.go
github	www.github.com/meshery/meshery/pull/10280

Parameter	Position	Path	Description	CWE
order	query param	/api/system/meshsync/resources/kinds	SQL injection vulnerability in GetMeshSyncResourcesKinds via the order query parameter enabling stacked queries and ATTACH DATABASE to perform arbitrary file write.	CWE-89

02 Sep 2025 20:46Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.9 - 8.1

EPSS0.00148

SSVC

CWE-89