Apache ShardingSphere-Proxy Incomplete Cleanup vulnerability

CRITICO 9.8CVE-2022-45347 · GHSA-wmxm-6wxc-3xqf · Published 22/12/2022 · updated 17/06/2026

In breve

CVE-2022-45347 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda org.apache.shardingsphere:shardingsphere-proxy, shardingsphere (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.5%, superiore al 73.9% delle vulnerabilità.
Correzione: aggiornare a 5.3.0 o successiva.

Package	Affected versions	Patched versions
org.apache.shardingsphere:shardingsphere-proxy Maven	`< 5.3.0`	`5.3.0`
shardingsphere apache	`< 5.3.0`	`5.3.0`

Description

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-45347 · ADVISORY
pjfanning/shardingsphere · PACKAGE
lists.apache.org/thread/l5rz7j4rg10o7ywtgknh2f5hxnv6yw3l · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free