CVE-2022-31011

Katalog CVE

CVSS 7.8 · High EPSS 0,32%

Kerentanan Improper Authentication pada pingcap tidb. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability. TiDB version 5.3.1 contains a patch for this issue. Other mitigation strategies include turning off Security Enhanced Mode (SEM), disabling local login for non-root accounts, and ensuring that the same IP cannot be logged in as root and normal user at the same time.

Rincian

Terbit di NVD

31 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pingcap/tidb/security/advisories/GHSA-4whx-7p29-mq22 mitigasi · advisory pihak ketiga
• https://github.com/pingcap/tidb/releases/tag/v5.3.1 release notes · advisory pihak ketiga