Improper input validation in GitHub Gh-Ost
CVE-2022-21687
gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server. The `-database` parameter does not properly sanitize user input which can lead to arbitrary file reads.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.010 (61.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 61st percentile — 61.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/github/gh-ost/security/advisories/GHSA-rrp4-2xx3-mv29 (Third Party Advisory)
- github.com/github/gh-ost/commit/a91ab042de013cfd8fbb633763438932d9080d8f (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-21687?
- CVE-2022-21687 is a medium-severity vulnerability in GitHub Gh-Ost, classified under Improper Input Validation. CVSS score: 6.8/10. Published 2022-02-01.
- How severe is CVE-2022-21687?
- Medium severity. CVSS v3 base score is 6.8 out of 10.