CVE-2024-29031: Meshery SQL Injection vulnerability

August 5, 2024

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.17 allows a remote attacker to obtain sensitive information via the order parameter of GetMeshSyncResources. Version 0.7.17 contains a patch for this issue.

References

github.com/advisories/GHSA-652r-q29p-m25h
github.com/meshery/meshery
github.com/meshery/meshery/commit/8e995ce21af02d32ef61689c1e1748a745917f13
github.com/meshery/meshery/pull/10207
nvd.nist.gov/vuln/detail/CVE-2024-29031
securitylab.github.com/advisories/GHSL-2023-249_Meshery

Code Behaviors & Features

Detect and mitigate CVE-2024-29031 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →