CVE-2022-31764

High

Description

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of this attack is that the attacker has obtained the account and password. Otherwise, the attacker cannot perform this attack.

SeverityHigh

CVSS8.5

Exploit probability—

Product

Apache Shardingsphere Elasticjob-ui

PublishedFeb 6, 2025

First seenFeb 6, 2025

Weakness typeCWE-913CWE-913

How to fix

Update

apache shardingsphere_elasticjob-ui3.0.2 or later

Vendor advisories

lists.apache.org/thread/pg0k223m4hsnnzg4nh7lxvdxxgbkrlqb

Affected products

Product	Affected versions	Fixed in
apache shardingsphere_elasticjob-ui	v < 3.0.2	3.0.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.