GitHub Advisoryadvisory · Go

GHSA-3jmm-f6jj-rcc3 rudder-server is vulnerable to SQL injection

CRITICAL Published 2024-08-05 Modified 2024-11-18 Official page ↗
Aliases
CVE-2023-30625
Ecosystem
Go
Packages
github.com/rudderlabs/rudder-server
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-08-05

Affected packages

• Go github.com/rudderlabs/rudder-server: < 1.3.0-rc.1 → fixed in 1.3.0-rc.1

Description

rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.

Related

Alias · CVE (1)

  • CVE-2023-30625 rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References