CVE-2024-10660
Published: 01 November 2024
Summary
CVE-2024-10660 is a medium-severity SQL Injection (CWE-89) vulnerability in Esafenet Cdg. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical SQL injection vulnerability was discovered in ESAFENET CDG 5 within the deleteHook function of the file /com/esafenet/servlet/policy/HookService.java. The flaw arises from improper handling of the hookId parameter, allowing an attacker to inject arbitrary SQL statements. The issue is tracked as CVE-2024-10660 and carries a CVSS 4.0 score of 5.3 under CWE-89.
An authenticated remote attacker can supply a crafted hookId value to the affected endpoint and execute unauthorized database queries. Successful exploitation can result in data disclosure, modification, or limited disruption of the application's backend operations. Public exploit details have already been shared, enabling potential reuse by threat actors with valid credentials.
The EPSS score stands at 0.6689 with no material increase from a lower baseline. No official patches or mitigation guidance appear in the referenced advisories.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33231
Vulnerability details
A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function deleteHook of the file /com/esafenet/servlet/policy/HookService.java. The manipulation of the argument hookId leads to sql injection. It is possible to initiate the attack remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing servlet (HookService.java) enables exploitation of public-facing applications (T1190), data collection from databases (T1213.006), and abuse of server software components (T1505) as noted in advisory.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.