Risk | High |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2022-41853 |
CWE-ID | CWE-749 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
HyperSQL database Server applications / Database software |
Vendor | HSQLDB |
This security bulletin contains one high risk vulnerability.
EUVDB-ID: #VU69302
Risk: High
CVSSv3.1:
CVE-ID: CVE-2022-41853
CWE-ID:
CWE-749 - Exposed Dangerous Method or Function
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to missing authorization when using java.sql.Statement or java.sql.PreparedStatement in hsqldb. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution.
MitigationInstall updates from vendor's website.
Vulnerable software versionsHyperSQL database: 2.0.0 - 2.7.0
http://hsqldb.org/doc/2.0/guide/sqlroutines-chapt.html#src_jrt_access_control
http://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50212#c7
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?