CVE-2022-35942

Katalog CVE

CVSS 10.0 · Critical EPSS 0,64%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada linuxfoundation loopback-connector-postgresql. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data stored on the connected database. A patch was released in version 5.5.1. This affects users who does any of the following: - Connect to the database via the DataSource with `allowExtendedProperties: true` setting OR - Uses the connector's CRUD methods directly OR - Uses the connector's other methods to interpret the LoopBack filter. Users who are unable to upgrade should do the following if applicable: - Remove `allowExtendedProperties: true` DataSource setting - Add `allowExtendedProperties: false` DataSource setting - When passing directly to the connector functions, manually sanitize the user input for the `contains` LoopBack filter beforehand.

Rincian

Terbit di NVD

12 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/loopbackio/loopback-connector-postgresql/commit/d57406c6737692a3a106b58a35406290cddb23e5 patch · advisory pihak ketiga
• https://github.com/loopbackio/loopback-connector-postgresql/security/advisories/GHSA-j259-6c58-9m58 mitigasi · advisory pihak ketiga