Cyber Resilience

CVE-2024-57652

HighPublic PoC

Published: 14 January 2025

Published
14 January 2025
Modified
17 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0038 59.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57652 is a high-severity SQL Injection (CWE-89) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 40.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-57652 affects the numeric_to_dv component in OpenLink Virtuoso Open-Source version 7.2.11. The vulnerability enables attackers to trigger a Denial of Service (DoS) condition through specially crafted SQL statements. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability, and is classified under CWE-89.

Remote attackers require no authentication or privileges and can exploit the issue over the network with low complexity and no user interaction. Successful exploitation results in a DoS, disrupting service availability without affecting confidentiality or integrity.

Mitigation details are available in the GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1198.

EU & UK References

Vulnerability details

An issue in the numeric_to_dv component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Remote unauthenticated SQL injection leading to application crash and DoS directly enables T1499.004 (Application or System Exploitation).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-57643Same product: Openlinksw Virtuoso
CVE-2024-57656Same product: Openlinksw Virtuoso
CVE-2024-57658Same product: Openlinksw Virtuoso
CVE-2024-57657Same product: Openlinksw Virtuoso
CVE-2024-57653Same product: Openlinksw Virtuoso
CVE-2024-57641Same product: Openlinksw Virtuoso
CVE-2024-57639Same product: Openlinksw Virtuoso
CVE-2024-57649Same product: Openlinksw Virtuoso
CVE-2024-57648Same product: Openlinksw Virtuoso
CVE-2024-57635Same product: Openlinksw Virtuoso

Affected Assets

openlinksw
virtuoso
7.2.11

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the flaw in the numeric_to_dv component of Virtuoso v7.2.11 that allows crafted SQL statements to trigger DoS.

SC-5 Denial-of-service Protection good match
preventdetect

Protects against denial-of-service events like this remote unauthenticated DoS via crafted SQL by implementing resource limits and traffic controls.

SI-10 Information Input Validation good match
prevent

Validates SQL statement inputs to the numeric_to_dv component, preventing exploitation through malformed or crafted queries.

References