Apache Shardingsphere vulnerabilities

3 CVEs affecting Apache Shardingsphere, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-28754, published 2023-07-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-1947, published 2020-03-11. Critical severity, CVSS 9.8. EPSS: 33.9% chance of exploitation in the next 30 days. In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to…
CVE-2023-28754, published 2023-07-19. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file. The attacker needs…
CVE-2022-45347, published 2022-12-22. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute…