Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-36111— immundb has insufficient verification of data authenticity

Quick assessment

Affected
codenotary immudb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

immudb是CodeNotary开源的一个基于零信任、SQL 和键值、防篡改、数据更改历史的不可变数据库。 immudb 1.4.1之前版本存在数据伪造问题漏洞，该漏洞源于恶意服务器可以提供伪造的证明，客户端SDK接受该证明之后会签署一个伪造的交易以取代真实的交易。

CVSS 5.4 · Medium EPSS 0.43% · P37

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-36111

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
immundb has insufficient verification of data authenticity
Source: CVE Program / CVE List V5
Vulnerability Description
immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a genuine immudb server and requires the client to perform a specific list of verified operations resulting in acceptance of an invalid state value. This vulnerability only affects immudb client SDKs, the immudb server itself is not affected by this vulnerability. This issue has been patched in version 1.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Vulnerability Title
immudb 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
immudb是CodeNotary开源的一个基于零信任、SQL 和键值、防篡改、数据更改历史的不可变数据库。 immudb 1.4.1之前版本存在数据伪造问题漏洞，该漏洞源于恶意服务器可以提供伪造的证明，客户端SDK接受该证明之后会签署一个伪造的交易以取代真实的交易。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
codenotary immudb < 1.4.1 -

II. Public POCs for CVE-2022-36111

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-36111

请登录查看更多情报信息。

Other References for CVE-2022-36111 (3)

IV. Related Vulnerabilities

Same product: immudb
Same vendor: codenotary
Same weakness: CWE-345