PT-2025-5826 · Apache · Apache Shardingsphere Elasticjob-Ui

Weijie Wu · Published 2022-11-01 · Updated 2025-07-16 · CVE-2022-31764

Positive Technologies · (AI Summary)

CVSS v3.1

8.5

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache ShardingSphere ElasticJob-UI versions prior to 3.0.2

Description: The issue allows an attacker to perform remote code execution (RCE) by constructing a special JDBC URL of the H2 database. The premise of this attack is that the attacker has obtained the account and password, as otherwise, the attack cannot be performed.

Recommendations: For versions prior to 3.0.2, update to ElasticJob-UI 3.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the H2 database or limiting the construction of special JDBC URLs until the update can be applied.

Fix

RCE

Weakness Enumeration

CWE-913

Related Identifiers

BDU:2025-03233

CVE-2022-31764

Affected Products

Apache Shardingsphere Elasticjob-Ui

References · 7

• https://lists.apache.org/thread/pg0k223m4hsnnzg4nh7lxvdxxgbkrlqb · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31764 · Security Note
• https://bdu.fstec.ru/vul/2025-03233 · Security Note
• https://t.me/cvedetector/17396 · Telegram Post
• https://twitter.com/CVEnew/status/1887512031873671413 · Twitter Post
• https://t.me/cvenotify/129109 · Telegram Post