What is the CVSS score of CVE-2022-35942?

CVE-2022-35942 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2022-35942?

Yes, a patch is available for CVE-2022-35942. Update the affected software to the latest version immediately.

PostgreSQL CVE-2022-35942

Q: Which versions of PostgreSQL are affected by CVE-2022-35942?

Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection.. A patch is available.

CRITICAL

SQL Injection (CWE-89)

2022-08-12 security-advisories@github.com

PostgreSQL SQLi Loopback Connector Postgresql

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Aug 12, 2022 - 23:15 nvd

CRITICAL 10.0

DescriptionNVD

Improper input validation on the contains LoopBack filter may allow for arbitrary SQL injection. When the extended filter property contains is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data stored on the connected database. A patch was released in version 5.5.1. This affects users who does any of the following: - Connect to the database via the DataSource with allowExtendedProperties: true setting OR - Uses the connector's CRUD methods directly OR - Uses the connector's other methods to interpret the LoopBack filter. Users who are unable to upgrade should do the following if applicable: - Remove allowExtendedProperties: true DataSource setting - Add allowExtendedProperties: false DataSource setting - When passing directly to the connector functions, manually sanitize the user input for the contains LoopBack filter beforehand.

AnalysisAI

Improper input validation on the contains LoopBack filter may allow for arbitrary SQL injection. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. Improper input validation on the contains LoopBack filter may allow for arbitrary SQL injection. When the extended filter property contains is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data stored on the connected database. A patch was released in version 5.5.1. This affects users who does any of the following: - Connect to the database via the DataSource with allowExtendedProperties: true setting OR - Uses the connector's CRUD methods directly OR - Uses the connector's other methods to interpret the LoopBack filter. Users who are unable to upgrade should do the following if applicable: - Remove allowExtendedProperties: true DataSource setting - Add allowExtendedProperties: false DataSource setting - When passing directly to the connector functions, manually sanitize the user input for the contains LoopBack filter beforehand. Affected products include: Linuxfoundation Loopback-Connector-Postgresql. Version information: version 5.5.1..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.