PT-2024-20579 · Unknown · Sqlalchemyda

Perrinjerome · Published 2024-02-07 · Updated 2024-02-14 · CVE-2024-24811

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SQLAlchemyDA versions prior to 2.2

Description A vulnerability in SQLAlchemyDA allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2.

Recommendations For versions prior to 2.2, update to version 2.2 to resolve the issue. As a temporary workaround is not available, upgrading to the patched version is the only recommended course of action.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-24811

GHSA-R3JC-3QMM-W3PW

Affected Products

Sqlalchemyda

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24811.json · Exploit
• https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw · Vendor Advisory
• https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a · Patch
• https://osv.dev/vulnerability/CVE-2024-24811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24811 · Security Note
• https://osv.dev/vulnerability/GHSA-r3jc-3qmm-w3pw · Vendor Advisory
• https://github.com/zopefoundation/Products.SQLAlchemyDA · Note
• https://t.me/cvenotify/70413 · Telegram Post
• https://t.me/cvenotify/70389 · Telegram Post
• https://twitter.com/CVEnew/status/1755248764015480861 · Twitter Post
• https://t.me/cvenotify/71414 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1755285325717373171 · Twitter Post