PT-2023-14712 · Talend · Talend Esb Runtime+1

Publicado 2023-02-03 · Atualizado 2025-03-26 · CVE-2022-45588

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Talend Remote Engine Gen 2 versions prior to R2022-09 Talend ESB Runtime versions prior to 7.3.1-R2022-09-RT Talend ESB Runtime versions prior to 8.0.1-R2022-10-RT

Description The issue is related to XML External Entity (XXE) and SQL Injection attacks. For the XXE vulnerability, it could only be exploited by someone with the appropriate rights to edit pipelines on the Talend platform and could not be triggered remotely or by other user input. The SQL Injection attacks are limited to the provisioning service.

Recommendations For Talend Remote Engine Gen 2 versions prior to R2022-09, download the R2022-09 release or later and use it in place of the previous version. For Talend ESB Runtime versions prior to 7.3.1-R2022-09-RT, upgrade to 7.3.1-R2022-09-RT or a later release. For Talend ESB Runtime versions prior to 8.0.1-R2022-10-RT, upgrade to 8.0.1-R2022-10-RT or a later release.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2022-45588

Produtos afetados

Talend Esb Runtime

Talend Remote Engine Gen 2

Referências · 6

• https://t.me/cvenotify/47438 · Publicação no Telegram
• https://t.me/cvenotify/116361 · Publicação no Telegram
• https://talend.com/security/incident-response/#CVE-2022-45588 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-45588 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-45588 · Aviso do Fabricante
• http://talend.com · Aviso do Fabricante