A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).
References
Link | Resource |
---|---|
https://github.com/layer5io/meshery/pull/2745 | Patch Third Party Advisory |
https://meshery.io | Product Vendor Advisory |
Configurations
History
No history.
Information
Published : 2021-04-28 06:15
Updated : 2024-02-28 18:28
NVD link : CVE-2021-31856
Mitre link : CVE-2021-31856
CVE.ORG link : CVE-2021-31856
JSON object : View
Products Affected
layer5
- meshery
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')