CVE-2024-24015

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Feb 6, 2024
Updated: Feb 10, 2024
CWE ID 89

Summary

CVE-2024-24015 is a SQL injection vulnerability that affects Novel-Plus v4.3.0-RC1 and earlier versions. The vulnerability allows an attacker to execute SQL commands by manipulating offset, limit, and sort parameters through the /sys/user/exit endpoint. The vulnerability has a high severity rating of 9.8 out of 10, with a critical impact on both confidentiality and integrity. No privileges are required for exploitation, and there is no user interaction needed. The attack vector is through the network, with low complexity and high availability impact. The affected products include tYx0EO, uCgQlC, t0OO-6, uCgQlA, uCgQlB, uREVN0, uCgQk6, uCgQk7, srBgF8, uCgQk4, uCgQk5, uCgQk-, uCgQk_, srBgF7, uCgQk8, uCgQk9, srBgF6, uCgQky, uCgQkz, uCgQk2, uCgQk3,u CgQk0,anduC g Q k1. Organizations should remediate this vulnerability promptly to prevent unauthorized access to their databases and potential data breaches.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-24015 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options