What is GHSA-r3jc-3qmm-w3pw?

GHSA-r3jc-3qmm-w3pw is a security advisory published by GitHub Security Advisories with Critical severity. SQLAlchemyDA unauthenticated arbitrary SQL query execution

Which CVE IDs does GHSA-r3jc-3qmm-w3pw cover?

GHSA-r3jc-3qmm-w3pw covers the following CVE IDs: CVE-2024-24811. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r3jc-3qmm-w3pw?

GHSA-r3jc-3qmm-w3pw has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-r3jc-3qmm-w3pw?

GHSA-r3jc-3qmm-w3pw affects 1 product, including: pip/Products.SQLAlchemyDA:\u003c 2.2.

GHSA-r3jc-3qmm-w3pwCriticalCVSS 9.8

SQLAlchemyDA unauthenticated arbitrary SQL query execution

Vendor

GitHub Security Advisories

Published

February 7, 2024

Last Modified

February 14, 2024

🔗 CVE IDs covered (1)

CVE-2024-24811 →

📋 Description

Impact

The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected.

Patches

The problem has been patched in version 2.2.

Workarounds

There is no workaround. All users are urged to upgrade to version 2.2

🎯 Affected products1

pip/Products.SQLAlchemyDA:< 2.2

🔗 References (4)

https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw
https://nvd.nist.gov/vuln/detail/CVE-2024-24811
https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a
https://github.com/advisories/GHSA-r3jc-3qmm-w3pw