Cyber Resilience

CVE-2024-57644

HighPublic PoC

Published: 14 January 2025

Published
14 January 2025
Modified
17 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0031 54.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57644 is a high-severity SQL Injection (CWE-89) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-57644 is a vulnerability in the itc_hash_compare component of OpenLink Virtuoso Open Source version 7.2.11. Published on 2025-01-14, it enables attackers to cause a Denial of Service (DoS) via crafted SQL statements. The issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and is linked to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command, or SQL Injection).

Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. By submitting crafted SQL statements, they can trigger the flawed itc_hash_compare function, resulting in a DoS condition as described.

Mitigation details are available in the GitHub issue tracker at https://github.com/openlink/virtuoso-opensource/issues/1193. Security practitioners should consult this reference for any patches, workarounds, or updates from the vendor.

EU & UK References

Vulnerability details

An issue in the itc_hash_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in a remotely accessible database component directly enables remote exploitation of a public-facing application to achieve DoS impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-57636Same product: Openlinksw Virtuoso
CVE-2024-57645Same product: Openlinksw Virtuoso
CVE-2024-57646Same product: Openlinksw Virtuoso
CVE-2024-57650Same product: Openlinksw Virtuoso
CVE-2024-57658Same product: Openlinksw Virtuoso
CVE-2024-57657Same product: Openlinksw Virtuoso
CVE-2024-57647Same product: Openlinksw Virtuoso
CVE-2024-57653Same product: Openlinksw Virtuoso
CVE-2024-57641Same product: Openlinksw Virtuoso
CVE-2024-57639Same product: Openlinksw Virtuoso

Affected Assets

openlinksw
virtuoso
7.2.11

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the CVE by requiring timely patching or remediation of the specific flaw in the itc_hash_compare component of Virtuoso v7.2.11.

SI-10 Information Input Validation good match
prevent

Prevents exploitation via crafted SQL statements by validating and sanitizing inputs to counter the SQL injection (CWE-89) in itc_hash_compare.

SC-5 Denial-of-service Protection partial match
prevent

Limits the effects of the DoS condition triggered by the vulnerability through denial-of-service protections.

References