PT-2023-14616 · Apache · Apache Cocoon

Qsec-Team · Publicado 2023-11-30 · Atualizado 2024-10-15 · CVE-2022-45135

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Cocoon versions 2.2.0 through 2.2.x (before 2.3.0) Apache Cocoon versions prior to 2.3.0

Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. Users are advised to upgrade to a fixed version.

Recommendations For Apache Cocoon versions 2.2.0 through 2.2.x, upgrade to version 2.3.0. For Apache Cocoon versions prior to 2.3.0, upgrade to version 2.3.0.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2022-45135

GHSA-8V4W-JR33-4RH3

Produtos afetados

Apache Cocoon

Referências · 11

• https://github.com/apache/cocoon · Nota
• https://t.me/cvenotify/61625 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-45135 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8v4w-jr33-4rh3 · Aviso do Fabricante
• https://lists.apache.org/thread/lsvd1hmr2t2q823x21d5ygzgbj9jpvjp · Aviso do Fabricante
• https://t.me/cvenotify/62360 · Publicação no Telegram
• https://t.me/cvenotify/61608 · Publicação no Telegram
• https://t.me/cvenotify/98153 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/11/30/3 · Nota
• https://osv.dev/vulnerability/CVE-2022-45135 · Aviso do Fabricante
• https://twitter.com/oss_security/status/1730325992533557490 · Publicação no Twitter