CVE-2022-39199

immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple servers. SDK does not validate this uuid and can accept any value reported by the server. A malicious server can change the reported UUID tricking the client to treat it as a different server thus accepting a state completely irrelevant to the one previously retrieved from the server. This issue has been patched in version 1.4.1. As a workaround, when initializing an immudb client object a custom state handler can be used to store the state. Providing custom implementation that ignores the server UUID can be used to ensure that even if the server changes the UUID, client will still consider it to be the same server.

• CWE-345

• https://github.com/codenotary/immudb/releases/tag/v1.4.1Release Notes, Third Party Advisory
• https://github.com/codenotary/immudb/security/advisories/GHSA-6cqj-6969-p57xThird Party Advisory
• https://github.com/codenotary/immudb/releases/tag/v1.4.1Release Notes, Third Party Advisory
• https://github.com/codenotary/immudb/security/advisories/GHSA-6cqj-6969-p57xThird Party Advisory

Published

Nov 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39193An issue was discovered in the CheckUser extension for Media…5.3
• CVE-2022-39194An issue was discovered in the MediaWiki through 1.38.2. The…4.9
• CVE-2022-39195A cross-site scripting (XSS) vulnerability in the LISTSERV 1…6.1
• CVE-2022-39196Blackboard Learn 1.10.1 allows remote authenticated users to…6.5
• CVE-2022-39197An XSS (Cross Site Scripting) vulnerability was found in Hel…6.1
• CVE-2022-39198A deserialization vulnerability existed in dubbo hessian-lit…9.8
• CVE-2022-3920HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 d…7.5
• CVE-2022-39200Dendrite is a Matrix homeserver written in Go. In affected v…5.3
• CVE-2022-39201Grafana is an open source observability and data visualizati…7.5
• CVE-2022-39202matrix-appservice-irc is an open source Node.js IRC bridge f…6.3
• CVE-2022-39203matrix-appservice-irc is an open source Node.js IRC bridge f…8.8
• CVE-2022-39205Onedev is an open source, self-hosted Git Server with CI/CD …9.8