PT-2024-29451 · Dtstack · Dtstack Taier

Nerowander · Published 2024-12-05 · Updated 2024-12-11 · CVE-2024-41579

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DTStack Taier version 1.4.0

Description The issue allows remote attackers to specify the jobName parameter in the listNames function of the console to cause a SQL injection. This can potentially lead to unauthorized access or manipulation of data.

Recommendations For DTStack Taier version 1.4.0, consider disabling the listNames function until a patch is available to prevent exploitation of the SQL injection vulnerability. Restrict access to the console to minimize the risk of remote attackers specifying the jobName parameter.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-41579

Affected Products

Dtstack Taier

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-41579 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41579 · Vendor Advisory
• https://github.com/DTStack/Taier/issues/1184 · Note
• https://gist.github.com/nerowander/380707503cfb078cbd6bed9fc9b12ad9 · Note
• https://t.me/cvenotify/103207 · Telegram Post
• https://twitter.com/CVEnew/status/1864752992253059395 · Twitter Post
• https://t.me/cvedetector/12133 · Telegram Post