openclarity/kubeclarity

openclarity/kubeclarity

GitHubGitHub
GitHubgithub.com
Releases129
Frequency1 week 5 days
Last Release
Stars44
KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2024-39909↗
6.5 MEDIUM—

KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean SQL Injection is present in the following resource `/api/applicationResources` via the following parameter `packageID`. As it can be seen in backend/pkg/database/id_view.go, while building the SQL Query the `fmt.Sprintf` function is used to build the query string without the input having first been subjected to any validation. This vulnerability is fixed in 2.23.1.