CVE-2022-36364
Last modified
CVE-2022-36364 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary classes and in rare cases remote code execution. To exploit the vulnerability: 1) the attacker needs to have privileges to control JDBC connection parameters; 2) and there should be a vulnerable class (constructor with URL parameter and ability to execute code) in the classpath. EPSS estimates a 2.19% chance of exploitation in the next 30 days.
Description
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary classes and in rare cases remote code execution. To exploit the vulnerability: 1) the attacker needs to have privileges to control JDBC connection parameters; 2) and there should be a vulnerable class (constructor with URL parameter and ability to execute code) in the classpath. From Apache Calcite Avatica 1.22.0 onwards, it will be verified that the class implements the expected interface before invoking its constructor.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Apache Calcite Avatica | < 1.22.0 |
References
- http://www.openwall.com/lists/oss-security/2022/07/28/1Mailing List, Third Party Advisory
- https://lists.apache.org/thread/5csdj8bv4h3hfgw27okm84jh1j2fyw0cMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/07/28/1Mailing List, Third Party Advisory
- https://lists.apache.org/thread/5csdj8bv4h3hfgw27okm84jh1j2fyw0cMailing List, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-36364?
How severe is CVE-2022-36364?
How do I fix CVE-2022-36364?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-36359An issue was discovered in the HTTP FileResponse class in Dj…8.8
- CVE-2022-3636A vulnerability was identified in Linux Kernel 33fc42de33278…7.8
- CVE-2022-36360A vulnerability has been identified in LOGO! 8 BM (incl. SIP…7.5
- CVE-2022-36361A vulnerability has been identified in LOGO! 12/24RCE (6ED10…9.8
- CVE-2022-36362A vulnerability has been identified in LOGO! 12/24RCE (6ED10…7.5
- CVE-2022-36363A vulnerability has been identified in LOGO! 12/24RCE (6ED10…5.3
- CVE-2022-36365Multiple Authenticated (contributor+) Stored Cross-Site Scri…5.4
- CVE-2022-36366Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2022-36367Incorrect default permissions in the Intel(R) Support Androi…4.4
- CVE-2022-36368Multiple stored cross-site scripting vulnerabilities in the …4.8
- CVE-2022-36369Improper access control in some QATzip software maintained b…7.8
- CVE-2022-3637A vulnerability has been found in Linux Kernel and classifie…5.5
Are you affected by CVE-2022-36364?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST