CVE-2024-57716
Published: 20 February 2025
Summary
CVE-2024-57716 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AU-13 (Monitoring for Information Disclosure) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-57716 is an information disclosure vulnerability (CWE-200) in trenoncourt AutoQueryable version 1.7.0. The issue lies in the Unselectable function, which enables a remote attacker to obtain sensitive information. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact with network vector, low attack complexity, and no requirements for privileges or user interaction.
A remote, unauthenticated attacker can exploit this vulnerability by targeting the affected Unselectable function. Exploitation requires no special privileges or user involvement and can be performed over the network with low complexity. Successful attacks result in the disclosure of sensitive information, with no impact on integrity or availability.
Advisories and further details are available in the vulnerability research repository at https://github.com/pentesttoolscom/vulnerability-research/tree/master/CVE-2024-57716 and the project repository at https://github.com/trenoncourt/AutoQueryable. The CVE was published on 2025-02-20T17:15:11.803.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4560
Vulnerability details
An issue in trenoncourt AutoQueryable v.1.7.0 allows a remote attacker to obtain sensitive information via the Unselectable function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated network exploitation of public-facing AutoQueryable function directly enables T1190 for sensitive data disclosure.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by identifying, reporting, and correcting the flaw in the Unselectable function that enables sensitive information disclosure.
Filters output prior to sharing with non-privileged remote attackers, preventing disclosure of sensitive information via the vulnerable Unselectable function.
Monitors for unauthorized disclosure of sensitive information, enabling detection of exploitation attempts targeting the Unselectable function.