CVE-2024-39909

KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean SQL Injection is present in the following resource `/api/applicationResources` via the following parameter `packageID`. As it can be seen in backend/pkg/database/id_view.go, while building the SQL Query the `fmt.Sprintf` function is used to build the query string without the input having first been subjected to any validation. This vulnerability is fixed in 2.23.1.

• CWE-89

• https://github.com/openclarity/kubeclarity/blob/main/backend/pkg/database/id_view.go#L79
• https://github.com/openclarity/kubeclarity/commit/1d1178840703a72d9082b7fc4aea0a3326c5d294
• https://github.com/openclarity/kubeclarity/security/advisories/GHSA-5248-h45p-9pgw
• https://github.com/openclarity/kubeclarity/blob/main/backend/pkg/database/id_view.go#L79
• https://github.com/openclarity/kubeclarity/commit/1d1178840703a72d9082b7fc4aea0a3326c5d294
• https://github.com/openclarity/kubeclarity/security/advisories/GHSA-5248-h45p-9pgw

Published

Jul 12, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39903Solara is a pure Python, React-style framework for scaling J…7.5
• CVE-2024-39904VNote is a note-taking platform. Prior to 3.18.1, a code exe…8.8
• CVE-2024-39905Red is a fully modular Discord bot. Due to a bug in Red's Co…5.3
• CVE-2024-39906A command injection vulnerability was found in the IndieAuth…8.3
• CVE-2024-399071Panel is a web-based linux server management control panel.…9.8
• CVE-2024-39908 REXML is an XML toolkit for Ruby. The REXML gem before 3.3.…4.3
• CVE-2024-3991The ShopLentor – WooCommerce Builder for Elementor & Gutenbe…5.4
• CVE-2024-39910decidim is a Free Open-Source participatory democracy, citiz…4.8
• CVE-2024-399111Panel is a web-based linux server management control panel.…9.8
• CVE-2024-39912web-auth/webauthn-lib is an open source set of PHP libraries…5.3
• CVE-2024-39914FOG is a cloning/imaging/rescue suite/inventory management s…9.8
• CVE-2024-39915Thruk is a multibackend monitoring webinterface for Naemon, …9.9