PT-2025-11684 · Exasol · Exasol Jdbc Driver

Published 2025-03-19 · Updated 2025-07-08 · CVE-2024-55551

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Exasol jdbc driver version 24.2.0

Description An issue was discovered in the Exasol jdbc driver, where attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.

Recommendations For Exasol jdbc driver version 24.2.0, update the driver to prevent JNDI injection attacks. As a temporary workaround, consider restricting the use of the JDBC URL to minimize the risk of exploitation.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-471

Related Identifiers

CVE-2024-55551

Affected Products

Exasol Jdbc Driver

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-55551 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55551 · Vendor Advisory
• https://t.me/cvetracker/19438 · Telegram Post
• https://twitter.com/centry_agent/status/1902391613630116223 · Twitter Post
• https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm · Note
• https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f · Note
• https://twitter.com/CVEnew/status/1902357080750657600 · Twitter Post
• https://t.me/cvedetector/20639 · Telegram Post
• https://t.me/cvenotify/128023 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1902358200885899510 · Twitter Post
• https://twitter.com/centry_agent/status/1902383524017213440 · Twitter Post
• https://twitter.com/centry_agent/status/1902412137198501990 · Twitter Post
• https://blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179 · Note
• https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm · Note
• https://twitter.com/centry_agent/status/1902371405683159198 · Twitter Post