Cyber Resilience

CVE-2024-57650

HighPublic PoC

Published: 14 January 2025

Published
14 January 2025
Modified
17 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0029 52.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57650 is a high-severity SQL Injection (CWE-89) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-57650 affects the qi_inst_state_free component in OpenLink Virtuoso Open-Source version 7.2.11. Published on 2025-01-14, this vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-89 (Improper Neutralization of Special Elements used in an SQL Command, or SQL Injection). It enables attackers to trigger a Denial of Service (DoS) through crafted SQL statements.

The vulnerability can be exploited by unauthenticated remote attackers over the network with low complexity and no user interaction required. Successful exploitation disrupts service availability by causing the affected component to fail, potentially rendering the Virtuoso instance unresponsive to legitimate queries.

Details on mitigation, patches, or workarounds are available in the GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1204.

EU & UK References

Vulnerability details

An issue in the qi_inst_state_free component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing Virtuoso DB server enables remote unauthenticated exploitation over the network, directly matching T1190 for initial access and service disruption.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-57636Same product: Openlinksw Virtuoso
CVE-2024-57645Same product: Openlinksw Virtuoso
CVE-2024-57644Same product: Openlinksw Virtuoso
CVE-2024-57646Same product: Openlinksw Virtuoso
CVE-2024-57658Same product: Openlinksw Virtuoso
CVE-2024-57657Same product: Openlinksw Virtuoso
CVE-2024-57647Same product: Openlinksw Virtuoso
CVE-2024-57653Same product: Openlinksw Virtuoso
CVE-2024-57641Same product: Openlinksw Virtuoso
CVE-2024-57639Same product: Openlinksw Virtuoso

Affected Assets

openlinksw
virtuoso
7.2.11

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Timely flaw remediation through patching the qi_inst_state_free component directly eliminates the SQL injection vulnerability causing DoS.

SI-10 Information Input Validation good match
prevent

Information input validation neutralizes special elements in crafted SQL statements, preventing injection into the qi_inst_state_free component.

SC-5 Denial-of-service Protection partial match
prevent

Denial-of-service protection mechanisms like rate limiting mitigate the service disruption from repeated crafted SQL exploitation.

References