PT-2023-14616 · Apache · Apache Cocoon

Qsec-Team · Published 2023-11-30 · Updated 2024-10-15 · CVE-2022-45135

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Cocoon versions 2.2.0 through 2.2.x (before 2.3.0) Apache Cocoon versions prior to 2.3.0

Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. Users are advised to upgrade to a fixed version.

Recommendations For Apache Cocoon versions 2.2.0 through 2.2.x, upgrade to version 2.3.0. For Apache Cocoon versions prior to 2.3.0, upgrade to version 2.3.0.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-45135

GHSA-8V4W-JR33-4RH3

Affected Products

Apache Cocoon

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-45135 · Security Note
• https://osv.dev/vulnerability/GHSA-8v4w-jr33-4rh3 · Vendor Advisory
• https://lists.apache.org/thread/lsvd1hmr2t2q823x21d5ygzgbj9jpvjp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45135 · Vendor Advisory
• https://github.com/apache/cocoon · Note
• https://t.me/cvenotify/61625 · Telegram Post
• https://t.me/cvenotify/62360 · Telegram Post
• https://t.me/cvenotify/61608 · Telegram Post
• https://t.me/cvenotify/98153 · Telegram Post
• http://openwall.com/lists/oss-security/2023/11/30/3 · Note
• https://twitter.com/oss_security/status/1730325992533557490 · Twitter Post