CVE-2025-62228
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-09

Last updated on: 2025-12-03

Assigner: Apache Software Foundation

Description
Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-09
Last Modified
2025-12-03
Generated
2026-06-16
AI Q&A
2025-10-09
EPSS Evaluated
2026-06-15
NVD
CVE-2025-62228
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache flink_cdc 3.4.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

Apache Flink CDC version 3.4.0 has a SQL injection vulnerability caused by maliciously crafted identifiers such as database names or table names. This means an attacker who is a logged-in database user can exploit these crafted identifiers to perform unauthorized SQL commands.

Mitigation Strategies

Update Apache Flink CDC to version 3.5.0, which addresses this SQL injection vulnerability. Since the attack requires a logged-in database user, ensure that database user privileges are properly managed and monitor for suspicious activity until the update is applied.

Impact Analysis

This vulnerability can allow an attacker with database access to execute unauthorized SQL commands, potentially leading to data manipulation, data leakage, or disruption of database operations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62228. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart