Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2022-31764

Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of this attack is that the attacker has obtained the account and password. Otherwise, the attacker cannot perform this attack.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache ShardingSphere ElasticJob-UI

  • 3.0.0 to ≤ 3.0.1affected

References