CVE-2022-21687

Katalog CVE

CVSS 6.5 · Medium EPSS 1,0%

Kerentanan Improper Input Validation pada github gh-ost. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server. The `-database` parameter does not properly sanitize user input which can lead to arbitrary file reads.

Rincian

Terbit di NVD

1 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 61,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/github/gh-ost/commit/a91ab042de013cfd8fbb633763438932d9080d8f patch · advisory pihak ketiga
• https://github.com/github/gh-ost/security/advisories/GHSA-rrp4-2xx3-mv29 advisory pihak ketiga