Lucene search

ApacheCVELIST:CVE-2022-45347

HistoryDec 22, 2022 - 10:47 a.m.

CVE-2022-45347 Apache ShardingSphere-Proxy: MySQL authentication bypass

2022-12-2210:47:44

CWE-459

apache

www.cve.org

apache

shardingsphere-proxy

mysql

authentication bypass

fix

cve-2022-45347

AI Score

9.9

Confidence

High

EPSS

0.03

Percentile

91.0%

JSON

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn’t cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache ShardingSphere-Proxy",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "5.3.0",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]

References

lists.apache.org/thread/l5rz7j4rg10o7ywtgknh2f5hxnv6yw3l