CVE-2022-22880

Description

Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.

How to fix CVE-2022-22880

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• Maven/org.jeecgframework.boot:jeecg-boot-base—no fix listed
• —no fix listed

Is CVE-2022-22880 being exploited?

Low — EPSS is 1.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, <= 3.0
• from 0, <= 3.0

CVSS scores

References (2)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-22880
• WEBgithub.com/jeecgboot/jeecg-boot/issues/3347