Platform
python
Component
products.sqlalchemyda
Fixed in
2.2.1
CVE-2024-24811 is a critical SQL Injection vulnerability affecting SQLAlchemyDA versions prior to 2.2. This flaw allows an attacker to execute arbitrary SQL statements against the connected database without authentication. All users of affected versions are vulnerable, and a patch is available in version 2.2.
The impact of this vulnerability is severe. An attacker can leverage SQL Injection to bypass authentication and authorization controls, gaining unauthorized access to sensitive data stored within the database. This could include user credentials, financial information, or other confidential data. Depending on the database schema and permissions, an attacker might also be able to modify or delete data, or even execute operating system commands on the database server. The lack of authentication required to exploit this vulnerability significantly broadens the attack surface.
This vulnerability was publicly disclosed on February 7, 2024. There are currently no known public exploits or active campaigns targeting this vulnerability. The CVSS score of 9.8 indicates a critical severity, suggesting a high potential for exploitation if left unaddressed. Monitor security advisories and threat intelligence feeds for any updates.
Exploit Status
EPSS
0.85% (75% percentile)
CVSS Vector
The primary mitigation for CVE-2024-24811 is to immediately upgrade to SQLAlchemyDA version 2.2 or later. Since there is no workaround, relying on other security measures is insufficient. Consider implementing strict database access controls and limiting database user privileges to minimize potential damage if the vulnerability is exploited before patching. Regularly review database activity logs for suspicious queries.
Update the Products.SQLAlchemyDA library to version 2.2 or higher. This version contains the security fix that prevents the execution of unauthenticated arbitrary SQL queries. To update, use the Python package manager (pip) or the installation method corresponding to your environment.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-24811 is a critical SQL Injection vulnerability in SQLAlchemyDA versions prior to 2.2, allowing attackers to execute arbitrary SQL commands without authentication.
Yes, if you are using SQLAlchemyDA version 2.2 or earlier, you are affected by this vulnerability. Upgrade immediately.
Upgrade to SQLAlchemyDA version 2.2 or later. There is no workaround for this vulnerability.
Currently, there are no known public exploits or active campaigns targeting this vulnerability, but its critical severity warrants immediate attention.
Refer to the SQLAlchemyDA project's official documentation and release notes for the latest information and security advisories: https://github.com/sdispirit/sqlalchemy_utils
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.