CVE-2022-45136

 

Published at: - 14-11-2022 05:15

Last modified: - 18-11-2022 12:14

Total changes: - 2

Description

** UNSUPPORTED WHEN ASSIGNED ** Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a result an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server. Apache Jena SDB has been EOL since December 2020 and users should migrate to alternative options e.g. Apache Jena TDB 2.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://lists.apache.org/thread/mc77cdl5stgjtjoldk467gdf756qjt31
• [oss-security] 20221114 CVE-2022-45136: JDBC Deserialisation in Apache Jena SDB-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2022-45136

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures