CVE-2022-35942: SQL Injection
First published: Fri Aug 12 2022(Updated: )
Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data stored on the connected database. A patch was released in version 5.5.1. This affects users who does any of the following: - Connect to the database via the DataSource with `allowExtendedProperties: true` setting OR - Uses the connector's CRUD methods directly OR - Uses the connector's other methods to interpret the LoopBack filter. Users who are unable to upgrade should do the following if applicable: - Remove `allowExtendedProperties: true` DataSource setting - Add `allowExtendedProperties: false` DataSource setting - When passing directly to the connector functions, manually sanitize the user input for the `contains` LoopBack filter beforehand.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linuxfoundation Loopback-connector-postgresql | <5.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-35942?
CVE-2022-35942 is a vulnerability in the `contains` LoopBack filter that allows for arbitrary SQL injection.
How does CVE-2022-35942 affect Linuxfoundation Loopback-connector-postgresql?
CVE-2022-35942 affects Linuxfoundation Loopback-connector-postgresql version up to 5.5.1 and may allow for arbitrary SQL injection.
What is the severity of CVE-2022-35942?
CVE-2022-35942 is classified as a critical vulnerability with a severity value of 10.
How can CVE-2022-35942 be exploited?
CVE-2022-35942 can be exploited by injecting arbitrary SQL code through the `contains` LoopBack filter property.
How to mitigate CVE-2022-35942?
To mitigate CVE-2022-35942, users should update to a version of Linuxfoundation Loopback-connector-postgresql that is not affected by the vulnerability.
- collector/nvd-index
- agent/references
- vendor/linuxfoundation
- canonical/linuxfoundation loopback-connector-postgresql