CVE-2024-35182

🗓️ 27 May 2024 19:08:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 55 Views🌐 WEB

Meshery open source manager SQL injection vulnerability may lead to arbitrary file write and unauthorized database access. Fixed in version 0.7.2

Reporter	Title	Published	Views	Family All 8
OSV	GHSA-H7CM-JVPP-69XF Meshery SQL Injection vulnerability	5 Aug 202421:29	–	osv
OSV	CVE-2024-35182	27 May 202419:15	–	osv
OSV	GO-2024-3051 Meshery SQL Injection vulnerability in github.com/layer5io/meshery	6 Aug 202422:40	–	osv
Cvelist	CVE-2024-35182 GHSL-2024-014 Meshery SQL Injection vulnerability	27 May 202418:18	–	cvelist
Veracode	SQL Injection	30 May 202410:40	–	veracode
Vulnrichment	CVE-2024-35182 GHSL-2024-014 Meshery SQL Injection vulnerability	27 May 202418:18	–	vulnrichment
NVD	CVE-2024-35182	27 May 202419:15	–	nvd
Github Security Blog	Meshery SQL Injection vulnerability	5 Aug 202421:29	–	github

Vulners

Vulnrichment

Node

meshery mesheryRange<0.7.22

[
  {
    "vendor": "meshery",
    "product": "meshery",
    "versions": [
      {
        "version": "< 0.7.22",
        "status": "affected"
      }
    ]
  }
]

Source	Link
securitylab	www.securitylab.github.com/advisories/GHSL-2024-013_GHSL-2024-014_Meshery/
github	www.github.com/meshery/meshery/blob/b331f45c9083d7abf6b90105072b04cd22473de7/server/models/events_persister.go
github	www.github.com/meshery/meshery/commit/b55f6064d0c6a965aee38f30281f99da7dc4420c
github	www.github.com/meshery/meshery/blob/b331f45c9083d7abf6b90105072b04cd22473de7/server/handlers/events_streamer.go
github	www.github.com/meshery/meshery/pull/10280

Parameter	Position	Path	Description	CWE
sort	query param	/api/v2/events	SQL injection vulnerability in the sort query parameter leading to arbitrary file write and data access.	CWE-89

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

27 May 2024 19:15Current

5.9Medium risk

Vulners AI Score5.9

CVSS35.9

EPSS0.00045

SSVC

CWE-89