CVE-2022-36111

Katalog CVE

CVSS 5.3 · Medium EPSS 0,41%

Kerentanan Insufficient Verification of Data Authenticity pada codenotary immudb. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a genuine immudb server and requires the client to perform a specific list of verified operations resulting in acceptance of an invalid state value. This vulnerability only affects immudb client SDKs, the immudb server itself is not affected by this vulnerability. This issue has been patched in version 1.4.1.

Rincian

Terbit di NVD

23 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/codenotary/immudb/releases/tag/v1.4.1 release notes · advisory pihak ketiga
• https://github.com/codenotary/immudb/security/advisories/GHSA-672p-m5jq-mrh8 exploit · advisory pihak ketiga
• https://github.com/codenotary/immudb/tree/master/docs/security/vulnerabilities/linear-fake exploit · advisory pihak ketiga
• https://pkg.go.dev/github.com/codenotary/immudb/pkg/client advisory pihak ketiga