CVE-2022-36084

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-36084
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36084.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-36084
Aliases
Published
2022-09-08T21:15:13Z
Modified
2026-08-12T03:51:40Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
cruddl vulnerable to AQL injection through flexSearch
Details

cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use @flexSearchFulltext are not affected. The attacker needs to have READ permission to at least one root entity type that has @flexSearchFulltext enabled. The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl. As a workaround, users can temporarily remove @flexSearchFulltext from their schemas.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-74",
        "CWE-943"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36084.json"
}
References

Affected packages

Git / github.com/aeb-labs/cruddl

Affected ranges

Type
GIT
Repo
https://github.com/aeb-labs/cruddl
Events
Introduced
3b40019039d9f00b09b2139da4c0364147d5a684
Fixed
c4ecd89f010fc1b685792bcd544130ce8f5bc185
Introduced
3471d6a6d6bd8933238b1fa888477684cc7ba176
Fixed
1914e8897e99e429340f16716b2b2ca9de63162c
Fixed
13b9233733ed6fc822718a07bc90a80cd3492698
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:aeb:cruddl:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "1.1.0"
        },
        {
            "fixed": "2.7.0"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.2.0
v1.2.0-alpha.0
v1.2.0-alpha.1
v1.2.0-alpha.2
v1.2.0-alpha.3
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.6.0
v1.7.0
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v2.*
v2.0.0
v2.0.0-alpha.0
v2.0.0-alpha.1
v2.0.0-alpha.2
v2.0.0-alpha.3
v2.0.0-alpha.4
v2.0.0-alpha.5
v2.1.0
v2.1.0-alpha.0
v2.1.0-alpha.1
v2.1.0-alpha.2
v2.2.0
v2.2.0-alpha.0
v2.2.0-alpha.1
v2.2.0-alpha.2
v2.2.0-alpha.3
v2.3.0
v2.3.0-alpha.0
v2.3.0-alpha.1
v2.3.0-alpha.2
v2.3.0-alpha.3
v2.4.0
v2.4.0-alpha.0
v2.4.0-alpha.1
v2.4.0-alpha.2
v2.4.1
v2.5.0
v2.5.0-alpha.0
v2.5.0-alpha.1
v2.5.0-alpha.2
v2.6.0
v2.6.0-alpha.0
v2.6.0-alpha.1
v2.6.0-alpha.2
v2.6.0-alpha.3
v2.6.0-alpha.4
v2.7.0-alpha.0
v2.7.0-alpha.1
v3.*
v3.0.0
v3.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36084.json"