CVE-2022-31764

Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC

State: Published
Severity: 8.5 High
Published: Feb 6, 2025
Updated: Feb 6, 2025
Reserved: May 27, 2022

Description

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of this attack is that the attacker has obtained the account and password. Otherwise, the attacker cannot perform this attack.

Scores

CVSS	Score	Vector	Source
3.1	8.5 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-913 Improper Control of Dynamically-Managed Code Resources

Affected Products

Product	Versions
Apache ShardingSphere ElasticJob-UIApache Software Foundation	3.0.0 through 3.0.1Affected

References

https://lists.apache.org/thread/pg0k223m4hsnnzg4nh7lxvdxxgbkrlqbvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.