CVE-2024-57648
Published: 14 January 2025
Description
An issue in the itc_set_param_row component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Security Summary
CVE-2024-57648 affects the itc_set_param_row component in OpenLink Virtuoso Open-Source version 7.2.11. The vulnerability enables attackers to trigger a Denial of Service (DoS) by sending crafted SQL statements. It is classified under CWE-89 (SQL Injection) with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its impact on availability.
Remote attackers without authentication or privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation disrupts service availability, potentially crashing the affected Virtuoso instance and rendering it unavailable to legitimate users.
Mitigation details are available in the referenced GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1195.
Details
- CWE(s)