{"id":"CVE-2022-24861","summary":"Remote Code Execution in Databasir","details":"Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code execution vulnerability. JDBC drivers are not validated prior to use and may be provided by users of the system. This can lead to code execution by any basic user who has access to the system. Users are advised to upgrade. There are no known workarounds to this issue.","aliases":["GHSA-5r2v-wcwh-7xmp"],"modified":"2026-08-12T13:00:02.354833Z","published":"2022-04-20T18:15:13Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24861.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24861.json"},{"type":"ADVISORY","url":"https://github.com/vran-dev/databasir/security/advisories/GHSA-5r2v-wcwh-7xmp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24861"},{"type":"FIX","url":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b"},{"type":"FIX","url":"https://github.com/vran-dev/databasir/pull/103"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vran-dev/databasir","events":[{"introduced":"b575a99392b72ecc83d9b8ff1247971ee46f8604"},{"fixed":"ca22a8fef7a31c0235b0b2951260a7819b89993b"}],"database_specific":{"cpe":"cpe:2.3:a:databasir:databasir:1.0.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0.1"},{"last_affected":"1.0.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.0.1","v1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24861.json","vanir_signatures_modified":"2026-08-12T13:00:02Z","vanir_signatures":[{"id":"CVE-2022-24861-12fed4b3","signature_type":"Line","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/main/java/com/databasir/core/infrastructure/connection/CustomDatabaseConnectionFactory.java"},"deprecated":false,"digest":{"line_hashes":["168638822367533708999295724271209412877","7973027464189809216183971626413378299","234594656529972948144747982082588502116","212079442042155044883280796660506916522","217821333997602452267479062258203750944","334100043151717034208673044190286026459","331300400865309830853847878800174657506","242971583309594875806161007288902348511","98192853296164757655193341841707678032","101922110806130492340499750496075921563","65245137665471233259569733345862263980","220449854483867142172710235058478586618","144894739078783528484110008876175496281"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/main/java/com/databasir/core/infrastructure/driver/DriverResources.java","function":"resolveSqlDriverNameFromJar"},"deprecated":false,"digest":{"function_hash":"207862764555291983133032575233531839986","length":302},"id":"CVE-2022-24861-171b399d"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/main/java/com/databasir/core/infrastructure/jwt/JwtTokens.java","function":"verify"},"deprecated":false,"digest":{"length":308,"function_hash":"182272887884154382979141637614853158458"},"id":"CVE-2022-24861-447da586"},{"source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/main/java/com/databasir/core/infrastructure/jwt/JwtTokens.java","function":"accessToken"},"deprecated":false,"digest":{"length":264,"function_hash":"212401170315403526672880084901761234629"},"id":"CVE-2022-24861-491b3fda","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"function":"getConnection","file":"core/src/main/java/com/databasir/core/infrastructure/connection/CustomDatabaseConnectionFactory.java"},"deprecated":false,"digest":{"function_hash":"34388907591975397672490516897424987208","length":1560},"id":"CVE-2022-24861-6828c47f","signature_type":"Function"},{"digest":{"function_hash":"39902158581073099052125632793173960823","length":327},"id":"CVE-2022-24861-6c28b6c4","signature_type":"Function","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/main/java/com/databasir/core/infrastructure/driver/DriverResources.java","function":"loadOrDownload"},"deprecated":false},{"target":{"file":"core/src/main/java/com/databasir/core/domain/database/service/DatabaseTypeService.java"},"deprecated":false,"digest":{"line_hashes":["278247518611315669284576126288069994340","43300075975306312704899891225974177409","87829364543039191830857802878621720561","5739729806500773120817269880987120013","192533539284267082761683446539972856892","147392564942581960541216735418484893864","44363311528834300755140098992547687029","300742777305109115526472921974993338271","6948400126057322338999424854796166377","306329777897565175056776191859874048934","42935362291603710086970575650790604779","27593944871018404880843723861946403167","279022197916362633344284604450496166989","153677043903015490871324374141046678943","78241784832858602385730984083581466700","170331312130902492277404692031237791825","102434939567102475405951452196835764847","230544116870433528344302654100171775349"],"threshold":0.9},"id":"CVE-2022-24861-764b4e06","signature_type":"Line","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b"},{"id":"CVE-2022-24861-8a37c549","signature_type":"Function","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/main/java/com/databasir/core/domain/database/service/DatabaseTypeService.java","function":"create"},"deprecated":false,"digest":{"length":252,"function_hash":"208052099444232222259072154038004234057"}},{"source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/test/java/com/databasir/core/domain/database/service/DatabaseTypeServiceTest.java"},"deprecated":false,"digest":{"line_hashes":["289607482849936404041514214929726190733","314206594078612764967776342246331011868","65366939591312824685203573138587131774","205490459792023567950839658485771072074","116945798885911801011975983416357145187","199135624437299976000735964380726754213","249807646654570300234390271314123973350","266543327010783333604870408527022612219","214363660946369507795077504223941533895","238296854433835254060112547170018262607","197568820959298887232436921894796715592","104274862524066545782626479869691957931","30896964794174190390676091694711691861","57022058502123510730182621408602959553"],"threshold":0.9},"id":"CVE-2022-24861-94eaac69","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/main/java/com/databasir/core/infrastructure/driver/DriverResources.java","function":"doDownload"},"deprecated":false,"digest":{"function_hash":"311160435237822421613772400693126945458","length":1179},"id":"CVE-2022-24861-b9cace06","signature_type":"Function"},{"target":{"file":"core/src/main/java/com/databasir/core/infrastructure/jwt/JwtTokens.java"},"deprecated":false,"digest":{"line_hashes":["264619194467691604415600012646334906244","338988373026934768346624834074486415358","244637067200609599024441805337714472636","72341688024085300292823488202725406606","213104321574458458098481281276814413973","23456984526558206192704414074243077367","287164706767489749324558344642282487453","17004998635197104313926699746347551706","180448265005988960576477536751675522224","273188944953764883480490362483124026928","322107325980658529227513578973626403175","122392078873191290437699323160836265096","140302256350026154232464425614408287926","144844936010768605472762584865276832469"],"threshold":0.9},"id":"CVE-2022-24861-be60c5b9","signature_type":"Line","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b"},{"deprecated":false,"digest":{"line_hashes":["143048779232794673067862274512481701872","109018921635816351238000353834166099813","276888524495602098113358454295657436483","2010320492342597027415183346081426930","268404840667821770957262427613532978285","161734310415599786751605855598094942989","22917071855917787315596883318778754628","281269777994389620102960028083223932488","260305253963410180762282497637230242285","213302243576231991304318028754862452546","254267103965439582440815495338101966575","106699578623604804508827261408821610496","93853142374147725872962681525551291666","153203455803321793642945142425980063732","200924307951775952900813609524041611774","263651463150773941230666120951216759740","178946818442160454110808523506755664864","272059092548066772686001078752833982296","22779320640972941014816824484679866118","212922020522883364157587572113303364321","306412022002180656232091667378135316893","16035626289083703781367853555590103309","274282338747567608856956867502208921119","178064146366750057859425792087065191612","332322706777021888077234079513833802131","231893373679937044807592603852795718372","156760024449405251371063275750753349370","115915150581921665931416231395274456218","55814866595459888473457586985691879159","157769149656079389636286101777091683613","317778686920887569477806645158491480509","252963282182930053981424132673160404782","54516329177404320959407445336745527118","212904016698797463958418155273729486901","214718868716839108647740083806625137958","147492985665013139881107268618765827683","180752496060245724780786425881246075026","131959849919205203596398434422872267708","108634555848602162609417049057745209370","161357780434900451049502349934402208204","208273223809460654491860857035159833805","81110641741864335044270995973402649796","20393577676382573769362267877594625560","20983279911121636726545479479679499316","330760764040263978978000873057447817699","243893894429879010901429380164288238990","32093044564846669740627911710359715355","29698268794041270230421663326903948178","257400435712578986365895475979257954837","229014794193002397059144623135722568087","152227856401325581592921844832750000652","294743839950037586679701877396959569964","89818830071975102755256571874441767890","73668611861987498943806997995522313162","131030186068003518155132637040617730704","310835804659496581918500364318122095628","321999754856367183230532315611685321732","22170598493570517321320039556678237466","88682012766537277792527778701259100266","278731174328302982279309817602881070282","320583146527415880956386051971692402655","248981420412825966086367824825763639753","97861598443761324072944638460877039345","199628679261541035347289415311329790612","305432978710131870400176778254441450622","250830455671618067608850143657425062668","231098047517894987579859758264247631843","275145219761326991520625923164572629837","292117744484522832977892368268983673519","176045349457431674113473469170703003246","240808883397390632708447474022573981685","199663833862157090901687683170221033946","95108182329246327529280049561891714297","112994851778052075986663588928298418600","187713260866904213741117966078232331575","332599963121796763674528346556071266517","42568438288773101797236899378851743242","46454951912010015510143729873963654451","337540672547880495500554857841969819358","122828780000485972036463598685953047423","40714602694917200921637064422636587210","306741729620737750096344802568510566009","246531390049245152267089561368400744507","217729491400652670391578839851019899187","296571909421591071155744389514956961998","181929402325393222471199131696770967077","231522163297359700354937670963541277097","221740650375550002626839744099948137269","301678230327408495206246132607700688887"],"threshold":0.9},"id":"CVE-2022-24861-ca4d4b23","signature_type":"Line","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/main/java/com/databasir/core/infrastructure/driver/DriverResources.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/main/java/com/databasir/core/domain/DomainErrors.java"},"deprecated":false,"digest":{"line_hashes":["241540629037698087059930233198244006024","225628612769492622480320765548443762722","134212757300637879081124658791458559983","18200649232913325317165107681572077181"],"threshold":0.9},"id":"CVE-2022-24861-d558ee5a"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/main/java/com/databasir/core/infrastructure/driver/DriverResources.java","function":"doResolveSqlDriverNameFromJar"},"deprecated":false,"digest":{"function_hash":"154165820507153300708997993535676008111","length":1060},"id":"CVE-2022-24861-d64a965a"},{"target":{"file":"core/src/main/java/com/databasir/core/domain/database/service/DatabaseTypeService.java","function":"resolveDriverClassName"},"deprecated":false,"digest":{"function_hash":"94329311974897955498047428399126840944","length":95},"id":"CVE-2022-24861-edd10686","signature_type":"Function","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b"},{"deprecated":false,"digest":{"function_hash":"126946173759598028692830328401591587680","length":672},"id":"CVE-2022-24861-ee37bd15","signature_type":"Function","signature_version":"v1","source":"https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b","target":{"file":"core/src/main/java/com/databasir/core/domain/database/service/DatabaseTypeService.java","function":"update"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}