ByteOS Network

NVD Vulnerability Details :

CVE-2018-25075

Modified

Source-cna@vuldb.com

Published At-15 Jan, 2023 | 20:15

Updated At-17 May, 2024 | 01:27

A vulnerability classified as critical has been found in karsany OBridge up to 1.3. Affected is the function getAllStandaloneProcedureAndFunction of the file obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java. The manipulation leads to sql injection. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.4 is able to address this issue. The name of the patch is 52eca4ad05f3c292aed3178b2f58977686ffa376. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218376.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	4.6	MEDIUM	CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Secondary	2.0	4.0	MEDIUM	AV:A/AC:H/Au:S/C:P/I:P/A:P

CPE Matches

obridge_project>>obridge>>Versions before 1.4(exclusive)

cpe:2.3:a:obridge_project:obridge:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Primary	cna@vuldb.com

References

Hyperlink	Source	Resource
https://github.com/karsany/obridge/commit/52eca4ad05f3c292aed3178b2f58977686ffa376	cna@vuldb.com	Patch Third Party Advisory
https://github.com/karsany/obridge/releases/tag/v1.4	cna@vuldb.com	Release Notes Third Party Advisory
https://vuldb.com/?ctiid.218376	cna@vuldb.com	Permissions Required Third Party Advisory
https://vuldb.com/?id.218376	cna@vuldb.com	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History