A SQL injection vulnerability exists in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms. This vulnerability allows a remote unauthenticated attacker to access or modify metering event data and potentially cause denial of service via crafted user-controlled JSONPath values submitted to the meters API. The vulnerability has been publicly disclosed and defenders should assess exposure and potenti [truncated]
OpenMeter contains a stored SQL injection vulnerability via customer usage-attribution values. Attackers can inject malicious values in usageAttribution.key or usageAttribution.subjectKeys when creating or updating a customer. These values are inserted into ClickHouse WITH map(...) expressions using string concatenation during meter or event queries. Affected versions: v1.0.0-beta.218 through v1.0.0-beta. [truncated]
