PT-2024-8800 · Intel · Intel Neural Compressor

Published 2024-11-12 · Updated 2024-11-15 · CVE-2024-39368

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Intel(R) Neural Compressor versions prior to v3.0

Description: The issue is related to improper neutralization of special elements used in an SQL command, also known as 'SQL Injection', in some Intel(R) Neural Compressor software. This may allow an authenticated user to potentially enable escalation of privilege via adjacent access. The vulnerability can be exploited by a remote attacker to elevate their privileges.

Recommendations: For versions prior to v3.0, upgrade to version v3.0 or later to prevent privilege escalation. As a temporary workaround, consider restricting access to the SQL command functionality until a patch is available. Avoid using the vulnerable software for sensitive operations until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-10432

CVE-2024-39368

Affected Products

Intel Neural Compressor

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-39368 · Security Note
• https://bdu.fstec.ru/vul/2024-10432 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01219.html · Note
• https://twitter.com/CVEnew/status/1856808151317925919 · Twitter Post
• https://twitter.com/CveFindCom/status/1856827418599682329 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1857028356321030548 · Twitter Post
• https://t.me/cvedetector/10894 · Telegram Post