Detections
Analytics

SCA: security update for github.com/layer5io/meshery (GHSA-h7cm-jvpp-69xf)

medium Tenable Cloud Security Plugin ID 415563

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based
 infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead
 to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command.
 Additionally, attackers may be able to access and modify any data stored in the database, like performance
 profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration
 added to the system. The Meshery project exposes the function `GetAllEvents` at the API URL
 `/api/v2/events`. The sort query parameter read in `events_streamer.go` is directly used to build a SQL
 query in `events_persister.go`. Version 0.7.22 fixes this issue by using the `SanitizeOrderInput`
 function. (CVE-2024-35182)

See Also

https://github.com/advisories/GHSA-h7cm-jvpp-69xf

Plugin Details

Severity: Medium

ID: 415563

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.37

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2024-35182

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.1

Threat Score: 5.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/5/2024

Vulnerability Publication Date: 5/27/2024

Reference Information

CVE: CVE-2024-35182

cwe: CWE-89