VulnerabilityAnalyzed
CVE-2024-55551
Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database.
HIGH 8.3EPSS 0.63%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.63%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.
- CVSS 3.1
- 8.3 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS
- 0.63% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-471
- Affected
- exasol/jdbc driver
- Source
- cve@mitre.org
References
- https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htmRelease Notes
- https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htmProduct
- https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0fThird Party Advisory
- https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179Technical Description
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.