CVE-2024-43406

HIGH

8.8

Descripcion

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. This vulnerability is fixed in 1.14.2.

Detalles CVE

Puntuacion CVSS v3.18.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado8/20/2024

Ultima modificacion8/26/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

lfedge:ekuiper

Debilidades (CWE)

CWE-89CWE-89

Referencias

https://github.com/lf-edge/ekuiper/commit/1a9c745649438feaac357d282959687012b65503(security-advisories@github.com)

https://github.com/lf-edge/ekuiper/security/advisories/GHSA-r5ph-4jxm-6j9p(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.