Detections
Analytics

SCA: security update for github.com/layer5io/meshery (GHSA-9f24-jrv4-f8g5)

medium Tenable Cloud Security Plugin ID 413229

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based
 infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead
 to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command.
 Additionally, attackers may be able to access and modify any data stored in the database, like performance
 profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration
 added to the system. The Meshery project exposes the function `GetMeshSyncResourcesKinds` at the API URL
 `/api/system/meshsync/resources/kinds`. The order query parameter is directly used to build a SQL query in
 `meshync_handler.go`. Version 0.7.22 fixes this issue. (CVE-2024-35181)

See Also

https://github.com/advisories/GHSA-9f24-jrv4-f8g5

Plugin Details

Severity: Medium

ID: 413229

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.37

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2024-35181

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6

Threat Score: 5.5

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/5/2024

Vulnerability Publication Date: 5/27/2024

Reference Information

CVE: CVE-2024-35181

cwe: CWE-89