PT-2024-17284 · Plextrac · Plextrac

Radisauskas Arnoldas · Published 2024-12-13 · Updated 2025-10-01 · CVE-2024-11837

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PlexTrac versions 1.61.3 through 2.8.1

Description The issue is related to the improper neutralization of special elements used in an N1QL command, allowing N1QL Injection. This problem can be exploited due to the lack of proper handling of special elements in N1QL commands.

Recommendations For PlexTrac versions 1.61.3 through 2.8.1, update to a version 2.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to N1QL commands to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-11837

Affected Products

Plextrac

References · 9

• https://osv.dev/vulnerability/CVE-2024-11837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11837 · Security Note
• https://t.me/cvedetector/12836 · Telegram Post
• https://docs.plextrac.com/plextrac-documentation/master/security-advisories#release-2.11.0 · Note
• https://t.me/cveNotify/137092 · Telegram Post
• https://twitter.com/CVEnew/status/1867537613936111666 · Twitter Post
• https://twitter.com/CveFindCom/status/1867449957357097040 · Twitter Post
• https://t.me/latest_high_impact_cve/1645 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1867485356502773773 · Twitter Post