CVE-2022-31196

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Databasir is a database metadata management platform. Databasir <= 1.06 has Server-Side Request Forgery (SSRF) vulnerability. The SSRF is triggered by a sending a **single** HTTP POST request to create a databaseType. By supplying a `jdbcDriverFileUrl` that returns a non `200` response code, the url is executed, the response is logged (both in terminal and in database) and is included in the response. This would allow an attackers to obtain the real IP address and scan Intranet information. This issue was fixed in version 1.0.7.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
vran-dev	databasir	< 1.0.7

References

https://github.com/vran-dev/databasir/commit/226c20e0c9124037671a91d6b3e5083bd2462058Patch, Third Party Advisory
https://github.com/vran-dev/databasir/releases/tag/v1.0.7Release Notes, Third Party Advisory
https://github.com/vran-dev/databasir/security/advisories/GHSA-qvg8-427f-852qExploit, Third Party Advisory
https://github.com/vran-dev/databasir/commit/226c20e0c9124037671a91d6b3e5083bd2462058Patch, Third Party Advisory
https://github.com/vran-dev/databasir/releases/tag/v1.0.7Release Notes, Third Party Advisory
https://github.com/vran-dev/databasir/security/advisories/GHSA-qvg8-427f-852qExploit, Third Party Advisory

Timeline

Published: Sep 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-311978.0PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java CVE-2022-311987.5OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module `Go CVE-2022-311999.8Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Audito CVE-2022-31209.8A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System. Affected by this vulnerability is an u CVE-2022-312006.1Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field CVE-2022-312015.4SoftGuard Web (SGW) before 5.1.5 allows HTML injection.CVE-2022-312026.5The export function in SoftGuard Web (SGW) before 5.1.5 allows directory traversal to read an arbitrary local file via export or man.tcl.CVE-2022-312047.5Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows CVE-2022-312057.5In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449..CVE-2022-312069.8The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentica CVE-2022-312079.8The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They uti CVE-2022-312088.8An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary commands by manipulating