GCVE - cpe:2.3:a:jackalope_doctrine-dbal_project:jackalope

Approved changes feed: RSS · Atom

cpe:2.3:a:jackalope_doctrine-dbal_project:jackalope_doctrine-dbal:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Jackalope Doctrine Dbal Project (`156c92a6-141a-548d-b1af-e9363d55f1e9`)
Product	Jackalope Doctrine Dbal (`c807012b-eb72-51a6-8198-74f8da786759`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL	Source	Last updated
`pkg:github/jackalope/jackalope-doctrine-dbal`	purl2cpe	2026-06-01 10:15:27.234551

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-43822`	vulnerable	2026-06-08 05:36:44.376560	SQL injection in jackalope/jackalope-doctrine-dbal HIGH (8.5) Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected. Published: 2021-12-13T19:50:11.000Z Updated: 2024-08-04T04:03:08.861Z Open on db.gcve.eu Reference links https://github.com/jackalope/jackalope-doctrine-dbal/security/advisories/GHSA-ph98-v78f-jqrm https://github.com/jackalope/jackalope-doctrine-dbal/commit/9d179a36d320330ddb303ea3a7c98d3a33d231db	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.