CVE-2015-2575 @ Maven-mysql:mysql-connector-java-5.1.26

[ksalman-Cx]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2015-2575
Applications: Kelseys-repos, All Projects, SCA examples, JVL
Checkmarx Project: ksalman-Cx-org-NA-kelsey-na/JavaVulnerableLab-base
Repository URL: https://github.com/ksalman-Cx-org-NA-kelsey-na/JavaVulnerableLab-base
Branch: master
Scan ID: cd689948-3efb-4ac2-ac29-ad38df553088

---

MySQL Connector/J before 5.1.35 is vulnerable to SQL Injection. The function quoteIdentifier() in the file src/com/mysql/jdbc/StringUtils.java doesn't check if the identifier is correctly quoted and if quotes within are correctly escaped in the given indentifier, allowing an attacker to inject malicious queries.

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: NONE
Remediation Upgrade Recommendation: 8.0.28