TI-2022-08640 Aliases CVE-2022-24827 GHSA-8xpj-9j9g-fc9r

SQL Injection in elide-datastore-aggregation

MEDIUM 40CWE-89Published 2022-04-11 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the '-' character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments ('--') and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01389 72nd percentileScored 2026-11-07

Fix Fixed com.yahoo.elide:elide-datastore-aggregation (Maven): 6.1.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
yahoo	elide	= 6.1.3	—	No fix listed	CNA
—	com.yahoo.elide:elide-datastore-aggregation (Maven)	6.1.3 to before 6.1.4	6.1.4	Patch available	GHSA-8xpj-9j9g-fc9r

elide Vendoryahoo Affected = 6.1.3 Fixed in — No fix listed CNA
com.yahoo.elide:elide-datastore-aggregation (Maven) Vendor— Affected 6.1.3 to before 6.1.4 Fixed in 6.1.4 Patch available GHSA-8xpj-9j9g-fc9r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elide:elide:6.1.3:::::::*	6.1.3	Vulnerable	Elide

cpe:2.3:a:elide:elide:6.1.3:*:*:*:*:*:*:* Versions 6.1.3 Vulnerable ·Elide

Remediation

Fix · GHSA-8xpj-9j9g-fc9r com.yahoo.elide:elide-datastore-aggregation (Maven) Fixed in 6.1.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-24827
2026-10-03 Alias added: GHSA-8xpj-9j9g-fc9r

References

Patch 1

https://github.com/yahoo/elide/pull/2581

Advisory 3

Other 1

https://github.com/yahoo/elide

TI-2007-03044 Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for… CVSS 2.0HIGH 9.3
TI-2026-62497 CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter CVSS 4.0HIGH 7.2
TI-2007-04373 Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the… CVSS 2.0HIGH 9.3
TI-2026-41720 Elide 7.1.17 - Permission Bypass in Sort Expression Validation CVSS 4.0MEDIUM 5.3
TI-2007-03904 Stack-based buffer overflow in the YDPCTL.YDPControl.1 (aka Yahoo! Installer Plugin for… CVSS 2.0HIGH 9.3
TI-2007-03045 Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for… CVSS 2.0HIGH 9.3

See all 75 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences