CVE-2024-24811

{"id": "CVE-2024-24811", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-02-07T15:15:08.507", "references": [{"url": "https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem."}, {"lang": "es", "value": "SQLAlchemyDA es un adaptador de base de datos gen\u00e9rico para m\u00e9todos ZSQL. Una vulnerabilidad encontrada en versiones anteriores a la 2.2 permite la ejecuci\u00f3n no autenticada de sentencias SQL arbitrarias en la base de datos a la que est\u00e1 conectada la instancia de SQLAlchemyDA. Todos los usuarios se ven afectados. El problema se solucion\u00f3 en la versi\u00f3n 2.2. No existe ning\u00fan workaround para el problema."}], "lastModified": "2024-02-14T20:26:39.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zope:sqlalchemyda:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26CB0366-8070-4564-8D4B-285BE5CB4C96", "versionEndExcluding": "2.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}