Cyber Resilience

CVE-2024-57636

HighPublic PoC

Published: 14 January 2025

Published
14 January 2025
Modified
17 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0029 52.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57636 is a high-severity SQL Injection (CWE-89) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-57636 is a vulnerability in the itc_sample_row_check component of OpenLink Virtuoso Open-Source version 7.2.11. The flaw allows attackers to trigger a Denial of Service (DoS) condition through specially crafted SQL statements. It has been assigned CWE-89 (Improper Neutralization of Special Elements used in an SQL Command, or SQL Injection) and a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation causes a DoS, disrupting service availability for legitimate users by crashing or overwhelming the affected Virtuoso instance, with no impact on confidentiality or integrity.

Mitigation details and further discussion are available in the GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1194, published on 2025-01-14. Security practitioners should review this reference for patches or workarounds specific to Virtuoso Open-Source deployments.

EU & UK References

Vulnerability details

An issue in the itc_sample_row_check component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated SQL injection on a public-facing database server directly enables exploitation of public-facing applications (T1190) to achieve DoS impact.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-57645Same product: Openlinksw Virtuoso
CVE-2024-57644Same product: Openlinksw Virtuoso
CVE-2024-57646Same product: Openlinksw Virtuoso
CVE-2024-57650Same product: Openlinksw Virtuoso
CVE-2024-57658Same product: Openlinksw Virtuoso
CVE-2024-57657Same product: Openlinksw Virtuoso
CVE-2024-57647Same product: Openlinksw Virtuoso
CVE-2024-57653Same product: Openlinksw Virtuoso
CVE-2024-57641Same product: Openlinksw Virtuoso
CVE-2024-57639Same product: Openlinksw Virtuoso

Affected Assets

openlinksw
virtuoso
7.2.11

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SQL injection in the itc_sample_row_check component by enforcing validation and sanitization of crafted SQL statement inputs.

SI-2 Flaw Remediation good match
prevent

Requires timely flaw remediation through patching the specific vulnerability in OpenLink Virtuoso v7.2.11 as detailed in the referenced GitHub issue.

SC-5 Denial-of-service Protection good match
prevent

Provides denial-of-service protection mechanisms to prevent service disruption from remote exploitation of the SQL injection flaw.

References