← Vulnerability feed

Vulnerability record · CVE-2022-45347 · published 22 December 2022

CVE-2022-45347: Apache shardingsphere vulnerability

Apache · Shardingsphere

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.

9.8 CVSS 3.1 Critical EPSS 1.4% · top 28.8% CWE-459 · CWE-459
9.8CVSS 3.1 base score
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/l5rz7j4rg10o7ywtgknh2f5hxnv6yw3l Mailing ListVendor Advisory
https://lists.apache.org/thread/l5rz7j4rg10o7ywtgknh2f5hxnv6yw3l Mailing ListVendor Advisory

Track CVE-2022-45347 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-1947Apache shardingsphere deserialization of untrusted data vulnerabilityIn Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load …EPSS 34%8.8CVE-2023-28754Apache shardingsphere deserialization of untrusted data vulnerabilityDeserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a sp…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2022-45347), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.