CVE-2023-52290

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-52290
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52290.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-52290
Published
2024-07-16T08:15:02.050Z
Modified
2026-03-14T12:16:48.022337Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection vulnerability. The attacker must successfully log into the system to launch an attack, which may cause data leakage. Since no data will be written, so this is a low-impact vulnerability.

Mitigation:

all users should upgrade to 2.1.4, Such parameters will be blocked.

References

Affected packages

Git / github.com/apache/incubator-streampark

Affected ranges

Type
GIT
Repo
https://github.com/apache/incubator-streampark
Events
Introduced
6788ebae61d2f6d5122572229ce0a3a2555cc46d
Fixed
c3c468c9192dd87b4ae430a41735bde7a391dfba
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.1.4"
        }
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.0-rc7
v2.1.0
v2.1.0-rc1
v2.1.1
v2.1.1-rc1
v2.1.2
v2.1.2-rc1
v2.1.2-rc2
v2.1.2-rc3
v2.1.2-rc4
v2.1.3
v2.1.3-rc1
v2.1.4-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52290.json"