CVE-2024-8503
Published: 10 September 2024
Summary
CVE-2024-8503 is a critical-severity SQL Injection (CWE-89) vulnerability in Korelogic (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-8503 is a time-based SQL injection vulnerability, tracked as CWE-89, affecting the VICIdial software platform. It carries a CVSS 3.1 score of 9.8 and permits an unauthenticated attacker to enumerate database records over the network. The application stores credentials in plaintext within the database by default.
An unauthenticated remote attacker can exploit the flaw without any user interaction or privileges to extract sensitive database contents, including the stored plaintext credentials, resulting in complete loss of confidentiality, integrity, and availability.
Public disclosures from KoreLogic and Full Disclosure on Seclists provide further technical details on the issue. The EPSS score has remained at a peak of 0.9310 since publication, indicating sustained exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49224
Vulnerability details
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.