Cyber Resilience

CVE-2024-57646

HighPublic PoC

Published: 14 January 2025

Published
14 January 2025
Modified
17 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0031 54.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57646 is a high-severity SQL Injection (CWE-89) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-57646 is a vulnerability in the psiginfo component of OpenLink Virtuoso OpenSource version 7.2.11. The issue, classified under CWE-89 (SQL Injection), enables attackers to cause a Denial of Service (DoS) condition through crafted SQL statements. It has a CVSS v3.1 base score of 7.5, reflecting network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), high integrity impact (I:H), and no availability impact (A:N).

Remote, unauthenticated attackers can exploit this vulnerability by sending specially crafted SQL statements to the affected component over the network. The low complexity and lack of required privileges or user interaction make it accessible to a wide range of adversaries, potentially allowing them to disrupt service integrity as indicated by the high integrity impact score.

For mitigation details, refer to the advisory in the GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1199.

EU & UK References

Vulnerability details

An issue in the psiginfo component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in network-accessible database component directly enables remote exploitation of public-facing application for DoS/integrity impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-57636Same product: Openlinksw Virtuoso
CVE-2024-57645Same product: Openlinksw Virtuoso
CVE-2024-57644Same product: Openlinksw Virtuoso
CVE-2024-57650Same product: Openlinksw Virtuoso
CVE-2024-57658Same product: Openlinksw Virtuoso
CVE-2024-57657Same product: Openlinksw Virtuoso
CVE-2024-57647Same product: Openlinksw Virtuoso
CVE-2024-57653Same product: Openlinksw Virtuoso
CVE-2024-57641Same product: Openlinksw Virtuoso
CVE-2024-57639Same product: Openlinksw Virtuoso

Affected Assets

openlinksw
virtuoso
7.2.11

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 requires validation of information inputs, directly preventing SQL injection attacks like CVE-2024-57646 by rejecting crafted SQL statements in the psiginfo component.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates identification, reporting, and correction of system flaws, directly addressing the specific SQL injection vulnerability in OpenLink Virtuoso v7.2.11.

SC-5 Denial-of-service Protection partial match
prevent

SC-5 protects against denial-of-service events, mitigating the service disruption caused by exploitation of this SQL injection vulnerability.

References