GitHub Advisoryadvisory · Maven

GHSA-wmxm-6wxc-3xqf Apache ShardingSphere-Proxy Incomplete Cleanup vulnerability

CRITICAL Published 2022-12-22 Modified 2023-01-02 Official page ↗
Aliases
CVE-2022-45347
Ecosystem
Maven
Packages
org.apache.shardingsphere:shardingsphere-proxy
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-459
Reviewed
2022-12-22

Affected packages

• Maven org.apache.shardingsphere:shardingsphere-proxy: < 5.3.0 → fixed in 5.3.0

Description

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.

Related

Alias · CVE (1)

  • CVE-2022-45347 Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client… vulnerability

Weakness · CWE (1)

  • CWE-459 Incomplete Cleanup weakness

References