PT-2024-39757 · Unknown · Dlp Extension

Published 2024-12-16 · Updated 2024-12-16 · CVE-2024-9678

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DLP Extension version 11.11.1.3

Description A vulnerability existed that allowed an attacker to perform arbitrary SQL queries, potentially leading to command execution. This issue was related to an SQL Injection vulnerability.

Recommendations For DLP Extension version 11.11.1.3, consider disabling or restricting access to the SQL query functionality until a patch is available. As a temporary workaround, restrict the ability to execute arbitrary SQL queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-9678

Affected Products

Dlp Extension

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-9678 · Security Note
• https://twitter.com/CVEnew/status/1868548910895284679 · Twitter Post
• https://t.me/cvenotify/104357 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1868571854648070302 · Twitter Post
• https://t.me/cvedetector/12968 · Telegram Post
• https://thrive.trellix.com/s/article/000013964 · Note