Vulnerability Description
In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection vulnerability. The attacker must successfully log into the system to launch an attack, which may cause data leakage. Since no data will be written, so this is a low-impact vulnerability. Mitigation: all users should upgrade to 2.1.4, Such parameters will be blocked.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Streampark | >= 2.0.0, < 2.1.4 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/t3mcm8pb65d9gj3wrgtj9sx9s2pfvvl3Mailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2024/07/15/4Mailing ListThird Party Advisory
- https://lists.apache.org/thread/t3mcm8pb65d9gj3wrgtj9sx9s2pfvvl3Mailing ListVendor Advisory
FAQ
What is CVE-2023-52290?
CVE-2023-52290 is a vulnerability with a CVSS score of 8.1 (HIGH). In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field....
How severe is CVE-2023-52290?
CVE-2023-52290 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-52290?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Streampark.