8.3

CVE-2024-55551

An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Exasol ≫ Jdbc Driver Version < 24.2.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.432
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cve@mitre.org 8.3 1.6 6
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-471 Modification of Assumed-Immutable Data (MAID)

The product does not properly protect an assumed-immutable element from being modified by an attacker.

https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179
Technical Description
https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm
Product
https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f
Third Party Advisory
https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm
Release Notes