Remote Code Execution in Apache ShardingSphere ElasticJob-UI
CVE-2022-31764

8.5HIGH

Key Information:

Vendor
Apache
Status
Apache Shardingsphere Elasticjob-ui
Vendor
CVE Published:
6 February 2025

Summary

The Lite UI in Apache ShardingSphere ElasticJob-UI is susceptible to a remote code execution attack when an attacker crafts a malicious JDBC URL targeting an H2 database. This vulnerability requires that the attacker has valid credentials, including both an account and password. The issue impacts versions 3.0.1 and earlier, but it has been addressed in ElasticJob-UI version 3.0.2.

Affected Version(s)

Apache ShardingSphere ElasticJob-UI 3.0.0 <= 3.0.1

References

https://lists.apache.org/thread/pg0k223m4hsnnzg4nh7lxvdxx...
vendor-advisory

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.