CVE-2024-57646
Published: 14 January 2025
Description
An issue in the psiginfo component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Security Summary
CVE-2024-57646 is a vulnerability in the psiginfo component of OpenLink Virtuoso OpenSource version 7.2.11. The issue, classified under CWE-89 (SQL Injection), enables attackers to cause a Denial of Service (DoS) condition through crafted SQL statements. It has a CVSS v3.1 base score of 7.5, reflecting network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), high integrity impact (I:H), and no availability impact (A:N).
Remote, unauthenticated attackers can exploit this vulnerability by sending specially crafted SQL statements to the affected component over the network. The low complexity and lack of required privileges or user interaction make it accessible to a wide range of adversaries, potentially allowing them to disrupt service integrity as indicated by the high integrity impact score.
For mitigation details, refer to the advisory in the GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1199.
Details
- CWE(s)