CVE-2020-35527CWE-119

CVE-2020-35527

Critical · published September 1, 2022

CVSS v3.1
9.8
EPSS
2%
Percentile
75.0
In the wild
Unconfirmed
What it is

⚠️ An out of bounds access in SQLite 3.31.1 could let crafty queries slip through unnoticed! 🚨 Think of it like a waiter accidentally bringing food to the wrong table because the order was misread — the dish is served, but it’s not what anyone signed up for! If exploited, this vulnerability could lead to unexpected behavior in your database views, potentially exposing sensitive data or causing data corruption. Imagine a dish served at the wrong table, and you realize the customer left a review you never intended to get!

Put simply

Think of it like a waiter accidentally bringing food to the wrong table because the order was misread — the dish is served, but it’s not what anyone signed up for! This out of bounds access occurs during ALTER TABLE operations for views with nested FROM clauses, allowing potentially harmful queries to bypass normal safeguards.

What to do

If exploited, this vulnerability could lead to unexpected behavior in your database views, potentially exposing sensitive data or causing data corruption. Imagine a dish served at the wrong table, and you realize the customer left a review you never intended to get! To mitigate this issue, upgrade SQLite to version 3.31.2 or later. Review your database operations to ensure integrity and restrict access where necessary. Regular audits of your database schema can help catch similar issues down the line. You've got this! With a quick patch, you can keep your data safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01557 · 75.0th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2022-09-01T22:15Z
Affected products (2)
ProductVersionsFixed in
sqlite/sqliteall versions—
netapp/ontap_select_deploy_administration_utilityall versions—
References (5)
EPSS history
Timeline
  • 01 SEP 00:00Z
    In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause
    cvelistv5