CVE-2022-25517

Опубликовано: 22 мар. 2022

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.java. NOTE: the vendor's position is that the reported execution of a SQL statement was intended behavior.

Ссылки

https://github.com/HaHarden/mybatis-plus-sql-Injection
Exploit
Third Party Advisory
https://github.com/baomidou/mybatis-plus/issues/4407
https://github.com/HaHarden/mybatis-plus-sql-Injection
Exploit
Third Party Advisory
https://github.com/baomidou/mybatis-plus/issues/4407

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:baomidou:mybatis-plus:3.4.3:*:*:*:*:*:*:*

EPSS

Процентиль: 58%

0.00359

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

CVE-2022-25517

CVSS3: 9.8

redhat

почти 4 года назад

GHSA-4m48-j3xj-px27

CVSS3: 9.8

github

почти 4 года назад

MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.java.

EPSS

Процентиль: 58%

0.00359

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89