CVE-2024-57642
Published: 14 January 2025
Description
An issue in the dfe_inx_op_col_def_table component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Security Summary
CVE-2024-57642 affects the dfe_inx_op_col_def_table component in OpenLink Virtuoso OpenSource version 7.2.11. The vulnerability enables attackers to trigger a Denial of Service (DoS) condition through crafted SQL statements. Classified under CWE-89 (SQL Injection), it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its high-impact availability disruption potential via network access with low complexity and no privileges required.
Remote attackers without authentication can exploit the flaw by submitting malicious SQL statements to the vulnerable component, causing the service to become unavailable. Exploitation results solely in a DoS, with no impact on confidentiality or integrity.
Mitigation details are available in the referenced GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1191.
Details
- CWE(s)