Vulnerability · Published May 1, 2023 · Assigned by apache
CVE-2022-45801Apache StreamPark (incubating): LDAP Injection Vulnerability
Medium 5.4
In plain English
A medium-severity injection in Apache StreamPark (incubating) from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through techniques similar to SQL Injection. LDAP injection attacks could result in the granting of permissions to unauthorized queries, and content modification inside the LDAP tree. This risk may only occur when the user logs in with ldap, and the user name and password login will not be affected, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.streampark:streampark | 2.0.0 | GHSA-pjfj-qvqw-3f6v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache StreamPark (incubating) | 1.0.0 – before 2.0.0 |
Weakness: CWE-74
References
- https://lists.apache.org/thread/xbkwwpkp3n2rs2wcxg8l26mhsftxwwr9 vendor-advisory