CVE-2024-55551
Exasol Jdbc Driver ≤ 24.2.1
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HSummary
CVE-2024-55551 is a high-severity MAID (CWE-471) vulnerability in Exasol Jdbc Driver. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-55551 affects the Exasol JDBC driver in versions prior to 24.2.1, released on 2024-12-10. The vulnerability enables attackers to inject malicious parameters into a JDBC URL, which triggers JNDI injection during the driver's connection process to the database. This flaw, classified as CWE-471, carries a CVSS v3.1 base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and can lead to remote code execution.
Exploitation targets users or applications that process untrusted JDBC URLs with the vulnerable driver. An attacker with network access must employ high-complexity techniques and rely on user interaction, such as tricking a victim into supplying or using a malicious URL in a Java application connecting to Exasol. Successful JNDI injection allows remote code execution in the context of the application process, with elevated scope impacting confidentiality, integrity, and availability at a high level.
Exasol mitigates this issue in JDBC driver version 24.2.1, as detailed in the official release notes. Administrators should upgrade to this version or later and review connection handling practices, per the driver documentation. Additional technical details, including a proof-of-concept, appear in a GitHub gist, with related context in a Black Hat Europe 2024 briefing on Java Authentication and Authorization Service (JAAS) attack surfaces.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54107
Vulnerability Data
An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can…
more
further lead to remote code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops unauthorized modification of elements that should remain immutable.
Least privilege reduces the set of subjects that can reach or alter assumed-immutable data.
Integrity verification tools discover unauthorized changes after they occur.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Least-privilege access controls directly block unauthorized writes to assumed-immutable data.
Integrity mechanisms for data-at-rest prevent modification of elements expected to remain immutable.
Protecting data-in-use integrity stops runtime tampering of values treated as constant.
Logical access controls reduce the attack surface for modifying internal assumed-immutable state.
Hardened configuration baselines limit opportunities to alter data presumed immutable.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect unauthorized modification paths for assumed-immutable data.
Secure SDLC practices include design reviews that identify and protect data assumed to be immutable.
Application security requirements can mandate integrity protections for data declared immutable.
Secure architecture principles call for explicit immutability guarantees and enforcement mechanisms.
Secure coding standards discourage mutable storage for values that must remain constant.
Access-control rules directly prevent unauthorized modification of data assumed to be immutable.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Windows 10 (1 rule)
- V-220812 Credential Guard must be running on Windows 10 domain-joined systems. prevents CWE-471