CVE-2024-57650
Published: 14 January 2025
Description
An issue in the qi_inst_state_free component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Security Summary
CVE-2024-57650 affects the qi_inst_state_free component in OpenLink Virtuoso Open-Source version 7.2.11. Published on 2025-01-14, this vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-89 (Improper Neutralization of Special Elements used in an SQL Command, or SQL Injection). It enables attackers to trigger a Denial of Service (DoS) through crafted SQL statements.
The vulnerability can be exploited by unauthenticated remote attackers over the network with low complexity and no user interaction required. Successful exploitation disrupts service availability by causing the affected component to fail, potentially rendering the Virtuoso instance unresponsive to legitimate queries.
Details on mitigation, patches, or workarounds are available in the GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1204.
Details
- CWE(s)