CVE-2024-55551

Katalog CVE

CVSS 8.3 · High EPSS 0,64%

Kerentanan Modification of Assumed-Immutable Data (MAID) pada exasol jdbc driver. Skor CVSS 3.1 8.3 (High) menurut mitre.org.

Deskripsi (NVD)

An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.

Rincian

Terbit di NVD

19 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.3 (High), sumber mitre.org
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-471: Modification of Assumed-Immutable Data (MAID)

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f advisory pihak ketiga
• https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm release notes
• https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm product
• https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-au... deskripsi teknis