All the vulnerabilites related to lf-edge - ekuiper
cve-2024-52812
Vulnerability from cvelistv5
Published
2025-03-10 17:52
Modified
2025-03-11 20:13
Severity ?
EPSS score ?
Summary
LF Edge eKuiper has Stored XSS in Rules Functionality
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-52812", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-03-11T20:12:43.168456Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-03-11T20:13:01.144Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "ekuiper", "vendor": "lf-edge", "versions": [ { "status": "affected", "version": "\u003c 2.0.8" } ] } ], "descriptions": [ { "lang": "en", "value": "LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule `id` parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim\u0027s browser. Version 2.0.8 fixes the issue." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-03-10T17:52:13.106Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "name": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-6hrw-x7pr-4mp8", "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-6hrw-x7pr-4mp8" }, { "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681" }, { "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716" }, { "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735" }, { "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794" }, { "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809" }, { "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824" }, { "name": "https://github.com/lf-edge/ekuiper/releases/tag/v2.0.8", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/lf-edge/ekuiper/releases/tag/v2.0.8" } ], "source": { "advisory": "GHSA-6hrw-x7pr-4mp8", "discovery": "UNKNOWN" }, "title": "LF Edge eKuiper has Stored XSS in Rules Functionality" } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2024-52812", "datePublished": "2025-03-10T17:52:13.106Z", "dateReserved": "2024-11-15T17:11:13.443Z", "dateUpdated": "2025-03-11T20:13:01.144Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43406
Vulnerability from cvelistv5
Published
2024-08-20 15:00
Modified
2024-08-20 17:42
Severity ?
EPSS score ?
Summary
LF Edge eKuiper has a SQL Injection in sqlKvStore
References
▼ | URL | Tags |
---|---|---|
https://github.com/lf-edge/ekuiper/security/advisories/GHSA-r5ph-4jxm-6j9p | x_refsource_CONFIRM | |
https://github.com/lf-edge/ekuiper/commit/1a9c745649438feaac357d282959687012b65503 | x_refsource_MISC |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:lfedge:ekuiper:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "ekuiper", "vendor": "lfedge", "versions": [ { "lessThan": "1.14.2", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-43406", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-08-20T17:39:48.544533Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-20T17:42:14.854Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "ekuiper", "vendor": "lf-edge", "versions": [ { "status": "affected", "version": "\u003c 1.14.2" } ] } ], "descriptions": [ { "lang": "en", "value": "LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. This vulnerability is fixed in 1.14.2." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-08-20T15:00:06.571Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "name": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-r5ph-4jxm-6j9p", "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-r5ph-4jxm-6j9p" }, { "name": "https://github.com/lf-edge/ekuiper/commit/1a9c745649438feaac357d282959687012b65503", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/lf-edge/ekuiper/commit/1a9c745649438feaac357d282959687012b65503" } ], "source": { "advisory": "GHSA-r5ph-4jxm-6j9p", "discovery": "UNKNOWN" }, "title": "LF Edge eKuiper has a SQL Injection in sqlKvStore" } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2024-43406", "datePublished": "2024-08-20T15:00:06.571Z", "dateReserved": "2024-08-12T18:02:04.966Z", "dateUpdated": "2024-08-20T17:42:14.854Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }