{"cve":"CVE-2022-45801","nvd":{"published":"2023-05-01T15:15:08.790","modified":"2026-06-17T05:10:45.710","status":"Modified","description":"Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability.\nLDAP Injection is an attack used to exploit web based applications\nthat construct LDAP statements based on user input. When an\napplication fails to properly sanitize user input, it's possible to\nmodify LDAP statements through techniques similar to SQL Injection.\nLDAP injection attacks could result in the granting of permissions to\nunauthorized queries, and content modification inside the LDAP tree.\nThis risk may only occur when the user logs in with ldap, and the user\nname and password login will not be affected, Users of the affected\nversions should upgrade to Apache StreamPark 2.0.0 or later.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cwes":["CWE-74"],"references":["https://lists.apache.org/thread/xbkwwpkp3n2rs2wcxg8l26mhsftxwwr9","https://lists.apache.org/thread/xbkwwpkp3n2rs2wcxg8l26mhsftxwwr9"],"products":["apache:streampark"],"source":"nvd","synced_at":"2026-10-19T21:38:05.473481323+00:00"},"epss":{"cve":"CVE-2022-45801","score":0.01103,"percentile":0.65728,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-pjfj-qvqw-3f6v","url":"https://osv.dev/vulnerability/GHSA-pjfj-qvqw-3f6v","summary":"Apache StreamPark LDAP Injection vulnerability","modified":"2023-11-08T04:10:53.760992Z","packages":[{"ecosystem":"Maven","name":"org.apache.streampark:streampark","purl":"pkg:maven/org.apache.streampark/streampark","ranges":[">=1.0.0 <2.0.0"],"fixed":["2.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}