What is GHSA-hvw5-3mgw-7rcf?

GHSA-hvw5-3mgw-7rcf is a security advisory published by GitHub Security Advisories with Medium severity. Debezium database connector has a script injection vulnerability

Which CVE IDs does GHSA-hvw5-3mgw-7rcf cover?

GHSA-hvw5-3mgw-7rcf covers the following CVE IDs: CVE-2023-1419. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hvw5-3mgw-7rcf?

GHSA-hvw5-3mgw-7rcf has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-hvw5-3mgw-7rcf?

GHSA-hvw5-3mgw-7rcf affects 3 products, including: maven/io.debezium:debezium-connector-mysql:\u003c 2.3.0.Alpha1; maven/io.debezium:debezium-connector-sqlserver:\u003c 2.3.0.Alpha1; maven/io.debezium:debezium-core:\u003c 2.3.0.Alpha1.

GHSA-hvw5-3mgw-7rcfMediumCVSS 5.9

Debezium database connector has a script injection vulnerability

Vendor

GitHub Security Advisories

Published

November 17, 2024

Last Modified

November 18, 2024

🔗 CVE IDs covered (1)

CVE-2023-1419 →

📋 Description

A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.

🎯 Affected products3

maven/io.debezium:debezium-connector-mysql:< 2.3.0.Alpha1
maven/io.debezium:debezium-connector-sqlserver:< 2.3.0.Alpha1
maven/io.debezium:debezium-core:< 2.3.0.Alpha1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-1419
https://access.redhat.com/security/cve/CVE-2023-1419
https://bugzilla.redhat.com/show_bug.cgi?id=2178722
https://github.com/debezium/debezium/commit/58ef4f0b98428cc795c2844eaa6e1762e8248227
https://github.com/advisories/GHSA-hvw5-3mgw-7rcf