{"id":"CVE-2024-29031","published":"2024-03-21T22:16:03Z","modified":"2024-08-13T16:48:48Z","title":"Meshery SQL Injection vulnerability","vendor":"meshery","product":"meshery","tier":"tail","description":{"text":"Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.17 allows a remote attacker to obtain sensitive information via the `order` parameter of `GetMeshSyncResources`. Version 0.7.17 contains a patch for this issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00959,"percentile":0.6153,"provenance":"source"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://securitylab.github.com/advisories/GHSL-2023-249_Meshery/","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/meshery/meshery/pull/10207","tags":["x_refsource_MISC"]},{"url":"https://github.com/meshery/meshery/commit/8e995ce21af02d32ef61689c1e1748a745917f13","tags":["x_refsource_MISC"]}],"priority":{"score":17.6,"factors":[{"name":"EPSS percentile","points":12.31},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"meshery","affectedVersions":[{"vendor":"meshery","product":"meshery","versions":["< 0.7.17"]}],"affected":[{"ecosystem":"Go","package":"github.com/layer5io/meshery","vulnerableRanges":["<0.7.17"],"patched":["0.7.17"],"from":["GHSA-652r-q29p-m25h","GO-2024-3045"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2508","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-meshery-cve-2024-29031","packageHistory":[{"cve":"CVE-2023-46575","published":"2023-11-24","fixed":"0.6.179","kev":false},{"cve":"CVE-2024-29031","published":"2024-03-21","fixed":"0.7.17","kev":false},{"cve":"CVE-2024-35181","published":"2024-05-27","fixed":"0.7.22","kev":false,"link":{"from":"CVE-2024-29031","to":"CVE-2024-35181","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/layer5io/meshery","fromFixed":"0.7.17","toFixed":"0.7.22","daysApart":67},{"kind":"similar","provenance":"machine","score":0.58,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2024-35182","published":"2024-05-27","fixed":"0.7.22","kev":false,"link":{"from":"CVE-2024-29031","to":"CVE-2024-35182","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/layer5io/meshery","fromFixed":"0.7.17","toFixed":"0.7.22","daysApart":67},{"kind":"similar","provenance":"machine","score":0.55,"basis":"same product + CWE + description similarity"}]}}],"package":"Go:github.com/layer5io/meshery"}}