CVE-2024-55551

An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm	Release Notes
https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm	Product
https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f	Third Party Advisory
https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179	Technical Description

Configurations

Configuration 1 (hide)

cpe:2.3:a:exasol:jdbc_driver:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-19 14:15

Updated : 2025-09-26 16:33

NVD link : CVE-2024-55551

Mitre link : CVE-2024-55551

CVE.ORG link : CVE-2024-55551

JSON object : View

Products Affected

exasol

jdbc_driver

CWE

CWE-471

Modification of Assumed-Immutable Data (MAID)

{"id": "CVE-2024-55551", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2025-03-19T14:15:37.733", "references": [{"url": "https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179", "tags": ["Technical Description"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-471"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Exasol jdbc driver 24.2.0. Los atacantes pueden inyectar par\u00e1metros maliciosos en la URL de JDBC, lo que activa la inyecci\u00f3n JNDI durante el proceso cuando el controlador JDBC utiliza esta URL para conectarse a la base de datos. Esto puede generar una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2025-09-26T16:33:56.420", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:exasol:jdbc_driver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A0D6AC6-6253-49C4-AE3E-A5E7E16F22F8", "versionEndExcluding": "24.2.1"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}