PT-2022-6585 · Apache · Apache Streampark

Huajie Wang · Published 2022-11-23 · Updated 2023-05-09 · CVE-2022-45801

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache StreamPark versions 1.0.0 through 2.0.0

Description The issue is related to an LDAP injection vulnerability, which is an attack used to exploit web-based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through techniques similar to SQL Injection. This could result in the granting of permissions to unauthorized queries and content modification inside the LDAP tree. The risk may only occur when the user logs in with LDAP, and the user name and password login will not be affected.

Recommendations For Apache StreamPark versions 1.0.0 through 2.0.0, upgrade to Apache StreamPark 2.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the LDAP functionality until the upgrade is applied. Additionally, users should be cautious when logging in with LDAP to minimize the risk of exploitation.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2023-02621

CVE-2022-45801

GHSA-PJFJ-QVQW-3F6V

Affected Products

Apache Streampark

References · 10

• https://osv.dev/vulnerability/GHSA-pjfj-qvqw-3f6v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45801 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45801 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02621 · Security Note
• https://lists.apache.org/thread/xbkwwpkp3n2rs2wcxg8l26mhsftxwwr9 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-45801 · Security Note
• https://github.com/apache/incubator-streampark · Note
• https://t.me/cvenotify/49503 · Telegram Post
• https://vuldb.com/ru/?id.224866 · Note
• https://t.me/cvenotify/49554 · Telegram Post