onyx --cves cve-2024-1597
CVE-2024-1597
- score
- <0.1
- cvss
- 10.0
- epss
- 4.8%
- published
- 2024-02-19
- kev added
- 2024-10-30
- first seen
pgjdbc PostgreSQL JDBC Driver versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 contain an SQL injection caused by improper handling of placeholders in PreferQueryMode=SIMPLE, letting attackers inject malicious SQL, exploit requires using PreferQueryMode=SIMPLE with specific placeholder construction.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Added to CISA KEV
- Tracked by Onyx
Weaknesses
References 10
- https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/
- https://lists.debian.org/debian-lts-announce/2024/05/msg00007.html
- https://security.netapp.com/advisory/ntap-20240419-0008/
- https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/
- https://www.reliaquest.com/blog/5-critical-threat-actors-you-need-to-know-about/
- http://www.openwall.com/lists/oss-security/2024/04/02/6
- https://lists.debian.org/debian-lts-announce/2024/12/msg00017.html
- https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TZQTSMESZD2RJ5XBPSXH3TIQVUW5DIUU/