CVE-2024-57651
Published: 14 January 2025
Summary
CVE-2024-57651 is a high-severity SQL Injection (CWE-89) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SQL injection in the jp_add component by validating crafted SQL statements to prevent DoS exploitation.
Remediates the specific flaw in OpenLink Virtuoso v7.2.11 through timely patching to eliminate the SQL injection vulnerability.
Protects system availability from the DoS condition triggered by crafted SQL statements in the vulnerable component.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing Virtuoso component directly enables remote unauthenticated exploitation (T1190) resulting in application DoS via crafted input (T1499.004).
NVD Description
An issue in the jp_add component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Deeper analysisAI
CVE-2024-57651 is a vulnerability in the jp_add component of OpenLink Virtuoso OpenSource version 7.2.11. The flaw allows attackers to trigger a Denial of Service (DoS) condition by sending crafted SQL statements. It is associated with CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation involves submitting specially crafted SQL statements to the affected jp_add component, resulting in a DoS that disrupts service availability without compromising confidentiality or integrity.
Mitigation details and further information are available in the referenced GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1196.
Details
- CWE(s)