Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability.
LDAP Injection is an attack used to exploit web based applications
that construct LDAP statements based on user input. When an
application fails to properly sanitize user input, it's possible to
modify LDAP statements through techniques similar to SQL Injection.
LDAP injection attacks could result in the granting of permissions to
unauthorized queries, and content modification inside the LDAP tree.
This risk may only occur when the user logs in with ldap, and the user
name and password login will not be affected, Users of the affected
versions should upgrade to Apache StreamPark 2.0.0 or later.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/xbkwwpkp3n2rs2wcxg8l26mhsftxwwr9 | Mailing List |
| https://lists.apache.org/thread/xbkwwpkp3n2rs2wcxg8l26mhsftxwwr9 | Mailing List |
Configurations
History
21 Nov 2024, 07:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/xbkwwpkp3n2rs2wcxg8l26mhsftxwwr9 - Mailing List |
09 May 2023, 18:09
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| References | (MISC) https://lists.apache.org/thread/xbkwwpkp3n2rs2wcxg8l26mhsftxwwr9 - Mailing List | |
| CPE | cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:* |
01 May 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-01 15:15
Updated : 2024-11-21 07:29
NVD link : CVE-2022-45801
Mitre link : CVE-2022-45801
CVE.ORG link : CVE-2022-45801
JSON object : View
Products Affected
apache
- streampark
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')