CVE-2024-32739
Published: 14 May 2024
Summary
CVE-2024-32739 is a high-severity SQL Injection (CWE-89) vulnerability in Cyberpower Powerpanel. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A SQL injection vulnerability exists in CyberPower PowerPanel Enterprise versions prior to 2.8.3. The flaw, tracked as CWE-89, resides in the query_ptask_verbose function within MCUDBHelper and permits leakage of sensitive information.
An unauthenticated remote attacker can exploit the issue over the network without credentials or user interaction, achieving high-impact confidentiality exposure as reflected in the CVSS 7.5 rating with an attack vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Release notes referenced by CyberPower and research published by Tenable indicate that upgrading to version 2.8.3 addresses the vulnerability.
The associated EPSS score reached a peak of 0.6806 with a current value of 0.6103.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-30526
Vulnerability details
A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_ptask_verbose" function within MCUDBHelper.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in a network-facing application (T1190: Exploit Public-Facing Application) enables unauthenticated remote attackers to leak sensitive information from the database (T1213.006: Data from Information Repositories - Databases).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.