CVE-2024-24021

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Feb 8, 2024
Updated: Feb 10, 2024
CWE ID 89

Summary

CVE-2024-24021 is a SQL injection vulnerability that affects Novel-Plus v4.3.0-RC1 and earlier versions. This vulnerability can be exploited by an attacker who passes specially crafted offset, limit, and sort parameters through the /novel/userFeedback/list endpoint, allowing them to execute malicious SQL commands. The vulnerability has a risk score of 65 and a base severity rating of CRITICAL. It does not require any privileges or user interaction, and can be exploited over the network. The impact of this vulnerability is considered high in terms of integrity and confidentiality. To remediate the issue, it is recommended to update to a newer version of Novel-Plus that addresses the SQL injection vulnerability. Failure to address this vulnerability can pose a significant danger to organizations as it allows attackers to manipulate the database and potentially gain unauthorized access or steal sensitive information.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-24021 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options