Veracode Vulnerability DatabaseVERACODE:48504SQL Injection
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
20.0%
github.com/lf-edge/ekuiper is vulnerable to SQL Injection. The vulnerability is due to insufficient input validation in the Get method of sqlKvStore, which allows the execution of malicious SQL queries.
References
github.com/advisories/GHSA-r5ph-4jxm-6j9p
github.com/lf-edge/ekuiper/blob/d6457d008e129b1cdd54d76b5993992c349d1b80/internal/pkg/store/sql/sqlKv.go#L138-L141
github.com/lf-edge/ekuiper/blob/d6457d008e129b1cdd54d76b5993992c349d1b80/internal/pkg/store/sql/sqlKv.go#L89-L93
github.com/lf-edge/ekuiper/blob/d6457d008e129b1cdd54d76b5993992c349d1b80/internal/server/rest.go#L274-L277
github.com/lf-edge/ekuiper/commit/1a9c745649438feaac357d282959687012b65503
github.com/lf-edge/ekuiper/pull/3100
github.com/lf-edge/ekuiper/security/advisories/GHSA-r5ph-4jxm-6j9p
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
20.0%