CVE-2024-57645

CVE-2024-57645 is a vulnerability in the qi_inst_state_free component of OpenLink Virtuoso OpenSource version 7.2.11. The issue allows attackers to cause a Denial of Service (DoS) condition through crafted SQL statements. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and is associated with CWE-89 (Improper Neutralization of Special Elements used in an SQL Command, or SQL Injection).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and without requiring user interaction. Exploitation involves sending crafted SQL statements, resulting in high integrity impact as indicated by the CVSS metrics, despite the description framing it as a DoS.

The GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1197 provides additional details on the vulnerability, including potential mitigation steps or patches for affected Virtuoso deployments.