Search

Find a vulnerability

Search criteria

    2 vulnerabilities by gcpaas

    CVE-2026-125381 (GCVE-0-2026-125381)

    Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
    VLAI
    Title
    DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSql
    Summary
    DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL backslash escapes, to execute injected SQL against the database.
    Severity
    6 (Medium)
    CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    VulnCheck CNA
    References
    Impacted products
    Vendor Product Version
    gcpaas DataRoom Affected: 0 , ≤ 3.0.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-22 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DataRoom",
          "vendor": "gcpaas",
          "versions": [
            {
              "lessThanOrEqual": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL backslash escapes, to execute injected SQL against the database."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:49.644Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/gcpaas/DataRoom/issues/25"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gcpaas/DataRoom"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gcpaas/DataRoom/blob/3.0.0/dataRoomServer/src/main/java/com/gccloud/gcpaas/dataroom/core/dataset/service/MyBatisService.java#L38-L66"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gcpaas/DataRoom/commit/d155312b23a91e39e5e934e3e2d2deede650b92b"
        },
        {
          "name": "VulnCheck Advisory: DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSql",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dataroom-through-3.0.0-sql-injection-via-mybatisservice-generatesql"
        }
      ],
      "title": "DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSql",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125381",
    "datePublished": "2026-11-09T23:27:49.644Z",
    "dateReserved": "2026-11-09T22:03:07.996Z",
    "dateUpdated": "2026-11-09T23:27:49.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125380 (GCVE-0-2026-125380)

    Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
    VLAI
    Title
    DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test
    Summary
    DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSourceCode and raw SELECT SQL to query any configured relational data source using its stored decrypted credentials, bypassing developer-only restrictions.
    Severity
    7.1 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    VulnCheck CNA
    References
    Impacted products
    Vendor Product Version
    gcpaas DataRoom Affected: 0 , ≤ 3.0.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-22 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DataRoom",
          "vendor": "gcpaas",
          "versions": [
            {
              "lessThanOrEqual": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSourceCode and raw SELECT SQL to query any configured relational data source using its stored decrypted credentials, bypassing developer-only restrictions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:48.947Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/gcpaas/DataRoom/issues/25"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gcpaas/DataRoom"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gcpaas/DataRoom/blob/3.0.0/dataRoomServer/src/main/java/com/gccloud/gcpaas/dataroom/core/dataset/DatasetController.java#L129-L133"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gcpaas/DataRoom/commit/4022eb30d44501aa502e08696e49cbd2a3b33ae7"
        },
        {
          "name": "VulnCheck Advisory: DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dataroom-through-3.0.0-incorrect-authorization-via-dataroom-dataset-run-test"
        }
      ],
      "title": "DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125380",
    "datePublished": "2026-11-09T23:27:48.947Z",
    "dateReserved": "2026-11-09T22:03:07.624Z",
    "dateUpdated": "2026-11-09T23:27:48.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}