CVE Feed

    Dashboard / CVE / CVE-2022-3023

    CVE-2022-3023

    Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3.

    Published:Nov 4, 2022
    Last Modified:May 2, 2025
    EPS:Nov 4, 2022
    EPSS Score:0.0009
    CVSS Score:9.8

    Affected Products

    Vendor
    Pingcap
    Product
    Tidb

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-135 Format String Injection
    CAPEC-67 String Format Overflow in syslog()

    Related CVEs

    CVE-2024-41434 (CVSS 4.3) — PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component (*Column).GetDecimal. This a…
    CVE-2024-41433 (CVSS 9.8) — PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component expression.ExplainExpression…
    CVE-2024-37820 (CVSS 5.4) — A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application …
    CVE-2024-33809 (CVSS 6.5) — PingCAP TiDB v7.5.1 was discovered to contain a buffer overflow vulnerability, which could lead to database cr…
    CVE-2024-35618 (CVSS 7.5) — PingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer.…
    CVE-2022-34969 (CVSS 7.5) — PingCAP TiDB v6.1.0 was discovered to contain a NULL pointer dereference.…
    CVE-2022-31011 (CVSS 7.8) — TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) wor…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High