CVE-2022-45801

Apache StreamPark (incubating): LDAP Injection Vulnerability

Description

Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through techniques similar to SQL Injection. LDAP injection attacks could result in the granting of permissions to unauthorized queries, and content modification inside the LDAP tree. This risk may only occur when the user logs in with ldap, and the user name and password login will not be affected, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.

Category

5.4
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.07%
Vendor Advisory apache.org
Affected: Apache Software Foundation Apache StreamPark (incubating)
Published at:
Updated at:

References

Link Tags
https://lists.apache.org/thread/xbkwwpkp3n2rs2wcxg8l26mhsftxwwr9 vendor advisory mailing list

Frequently Asked Questions

What is the severity of CVE-2022-45801?
CVE-2022-45801 has been scored as a medium severity vulnerability.
How to fix CVE-2022-45801?
To fix CVE-2022-45801, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-45801 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-45801 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-45801?
CVE-2022-45801 affects Apache Software Foundation Apache StreamPark (incubating).
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.