CVE-2022-45347

Summary

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.

Affected Software

VendorProductVersion RangeStatus
Apache Software FoundationApache ShardingSphere-Proxy0 < 5.3.0affected

Weaknesses

  • CWE-459: CWE-459 Incomplete Cleanup

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References