CVE-2024-57649
Published: 14 January 2025
Description
An issue in the qst_vec_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Security Summary
CVE-2024-57649 is a vulnerability in the qst_vec_set component of OpenLink Virtuoso Open-Source version 7.2.11. It enables attackers to cause a Denial of Service (DoS) condition through crafted SQL statements. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and is linked to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command, or SQL Injection). The CVE was published on 2025-01-14.
Remote attackers can exploit this vulnerability without authentication or user interaction, as it is network-accessible with low attack complexity. Successful exploitation allows manipulation of data integrity (high impact), though the description emphasizes DoS effects, with no reported impacts on confidentiality or availability per the CVSS vector.
Mitigation details are available in the referenced GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1206.
Details
- CWE(s)