CVE-2024-55551

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-55551
An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.

8.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm Release Notes
https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm Product
https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f Third Party Advisory
https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179 Technical Description
Configurations

Configuration 1 (hide)

cpe:2.3:a:exasol:jdbc_driver:*:*:*:*:*:*:*:*
History

08 Jul 2025, 16:44

Type Values Removed Values Added
CPE cpe:2.3:a:exasol:jdbc_driver:*:*:*:*:*:*:*:*
First Time Exasol
Exasol jdbc Driver
References () https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm - () https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm - Release Notes
References () https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm - () https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm - Product
References () https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f - () https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f - Third Party Advisory
References () https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179 - () https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179 - Technical Description

02 Apr 2025, 14:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.0 		v2 : unknown
v3 : 8.3

25 Mar 2025, 17:16

Type Values Removed Values Added
CWE CWE-471
References
  • () https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm -
Summary
  • (es) Se detectó un problema en Exasol jdbc driver 24.2.0. Los atacantes pueden inyectar parámetros maliciosos en la URL de JDBC, lo que activa la inyección JNDI durante el proceso cuando el controlador JDBC utiliza esta URL para conectarse a la base de datos. Esto puede generar una vulnerabilidad de ejecución remota de código.
Summary (en) An issue was discovered in Exasol jdbc driver 24.2.0. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution vulnerability. (en) An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 9.0

19 Mar 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-94

19 Mar 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-19 14:15

Updated : 2025-07-08 16:44

NVD link : CVE-2024-55551

Mitre link : CVE-2024-55551

CVE.ORG link : CVE-2024-55551

JSON object : View

Products Affected

exasol

  • jdbc_driver
CWE
CWE-471

Modification of Assumed-Immutable Data (MAID)

CWE-94

Improper Control of Generation of Code ('Code Injection')