[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAKYehMbX4+vq2adrfE0wpK0uGoORMOeewXB2F=8h1EWzp14h-A@mail.gmail.com>
Date: Fri, 21 Apr 2023 00:05:14 +0800
From: Huajie Wang <benjobs@...che.org>
To: oss-security@...ts.openwall.com
Cc: dev <dev@...eampark.apache.org>
Subject: CVE-2022-45801: Apache StreamPark (incubating): LDAP Injection Vulnerability
Apache StreamPark (incubating): LDAP Injection Vulnerability
Severity: Moderate
Versions Affected:
Apache StreamPark 1.0.0 before 2.0.0
Description:
Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability.
LDAP Injection is an attack used to exploit web based applications
that construct LDAP statements based on user input. When an
application fails to properly sanitize user input, it's possible to
modify LDAP statements through techniques similar to SQL Injection.
LDAP injection attacks could result in the granting of permissions to
unauthorized queries, and content modification inside the LDAP tree.
This risk may only occur when the user logs in with ldap, and the user
name and password login will not be affected, Users of the affected
versions should upgrade to Apache StreamPark 2.0.0 or later
Mitigation:
Users of the affected versions should apply one of the following
- Upgrade to Apache StreamPark 2.0.0 or later
References:
https://streampark.incubator.apache.orghttps://www.cve.org/CVERecord?id=CVE-2022-45801
Best,
Huajie Wang
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
