CVE-2022-36084

    Dashboard / Vulnerabilities / CVE-2022-36084

    CVE-2022-36084

    Published: 8 Sept 2022Last Modified: 12 Aug 2026

    Summary: cruddl vulnerable to AQL injection through flexSearch

    Details: cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFulltext` are not affected. The attacker needs to have `READ` permission to at least one root entity type that has `@flexSearchFulltext` enabled. The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl. As a workaround, users can temporarily remove `@flexSearchFulltext` from their schemas.

    References: https://github.com/AEB-labs/cruddl/security/advisories/GHSA-qm4w-4995-vg7f, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36084.json, https://nvd.nist.gov/vuln/detail/CVE-2022-36084, https://github.com/AEB-labs/cruddl/commit/13b9233733ed6fc822718a07bc90a80cd3492698, https://github.com/AEB-labs/cruddl/pull/253

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 3b40019039d9f00b09b2139da4c0364147d5a684
    Fixed -c4ecd89f010fc1b685792bcd544130ce8f5bc185

    Affected versions

    v3.0.1
    v3.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-36084 | CVE-DB