CVE-2024-24811: products-sqlalchemyda - Unauthenticated Arbitrary SQL Query Execution
Summary
CVE-2024-24811: SQLAlchemyDA unauthenticated arbitrary SQL query execution. Affects products-sqlalchemyda versions < 2.2. Fixed in 2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
products-sqlalchemyda is a Python package available on PyPI that provides a SQLAlchemy database adapter for the Products.CMFCore content management framework. It allows developers to interact with databases using SQLAlchemy's Object-Relational Mapping (ORM) capabilities. This vulnerability affects all users of products-sqlalchemyda.
Vulnerability Detail
The vulnerability in products-sqlalchemyda allows unauthenticated execution of arbitrary SQL statements on the connected database. This means that an attacker can execute any SQL query without providing any authentication credentials. The impact of this vulnerability is critical as it can lead to unauthorized access, data manipulation, or even complete compromise of the database. The vulnerability has been assigned a CVSS score of 9.8, indicating its severity.
How To Fix
Minimum fixed version
2.2
This is the first release that contains the fix.
pip install --upgrade "products-sqlalchemyda==2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in products-sqlalchemyda allows unauthenticated execution of arbitrary SQL queries, posing a significant risk to the connected database. Users are strongly advised to upgrade to version 2.2 of products-sqlalchemyda to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for products-sqlalchemyda →
FAQ
All users of products-sqlalchemyda are affected by this vulnerability.
The vulnerability allows unauthenticated execution of arbitrary SQL statements on the connected database, potentially leading to unauthorized access, data manipulation, or complete compromise of the database.
Yes, the vulnerability has been patched in version 2.2 of products-sqlalchemyda.
To fix this vulnerability, upgrade to version 2.2 of products-sqlalchemyda.
No, there is no known workaround for this vulnerability. Upgrading to the patched version is the recommended solution.
