PT-2024-21654 · Unknown · So Planning Tool

Hidde Smit + 1 · Published 2024-09-11 · Updated 2024-09-18 · CVE-2024-27112

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SO Planning tool versions prior to 1.52.02

Description A SQL Injection issue has been found in the SO Planning tool when the public view setting is enabled, allowing an attacker to gain access to the underlying database.

Recommendations For versions prior to 1.52.02, update to version 1.52.02 to resolve the issue. As a temporary workaround, consider disabling the public view setting until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-27112

Affected Products

So Planning Tool

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-27112 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27112 · Vendor Advisory
• https://t.me/cvenotify/95142 · Telegram Post
• https://t.me/cvedetector/5362 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1833909537771794448 · Twitter Post
• https://twitter.com/CVEnew/status/1833865953735778345 · Twitter Post
• https://twitter.com/CveFindCom/status/1833868846563831921 · Twitter Post
• https://csirt.divd.nl/CVE-2024-27112 · Note