exploitDog

CVE-2021-31856

Опубликовано: 28 апр. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Высокий

Описание

A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).

Ссылки

https://github.com/layer5io/meshery/pull/2745
Patch
Third Party Advisory
https://meshery.io
Product
Vendor Advisory
https://github.com/layer5io/meshery/pull/2745
Patch
Third Party Advisory
https://meshery.io
Product
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:layer5:meshery:0.5.2:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.79924

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-8xr7-2xrh-vgwj

github

больше 3 лет назад

A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).

EPSS

Процентиль: 99%

0.79924

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89