CVE-2024-53678
Last modified
CVE-2024-53678 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when requesting a new Block Allocation such that a SELECT SQL statement is modified. EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when requesting a new Block Allocation such that a SELECT SQL statement is modified. The data returned by the SELECT statement is not viewable by the attacker. This issue affects all versions of Apache VCL from 2.2 through 2.5.1. Users are recommended to upgrade to version 2.5.2, which fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Vcl | >= 2.2, < 2.5.2 |
References
- https://lists.apache.org/thread/2bmjnzgjwwq59nv6xw44w0tnpz4k4pf4Issue Tracking, Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/03/24/1Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-53678?
How severe is CVE-2024-53678?
How do I fix CVE-2024-53678?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-53672A vulnerability in the ClearPass Policy Manager web-based ma…6.3
- CVE-2024-53673A java deserialization vulnerability in HPE Remote Insight S…9.8
- CVE-2024-53674An XML external entity injection (XXE) vulnerability in HPE …7.5
- CVE-2024-53675An XML external entity injection (XXE) vulnerability in HPE …7.5
- CVE-2024-53676A directory traversal vulnerability in Hewlett Packard Enter…9.8
- CVE-2024-53677File upload logic in Apache Struts is flawed. An attacker ca…9.8
- CVE-2024-53679Improper Neutralization of Input During Web Page Generation …5.4
- CVE-2024-5368A vulnerability was found in Kashipara College Management Sy…6.1
- CVE-2024-53680In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-53681In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-53682In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-53683A valid set of credentials in a .js file and a static token …5.6
Are you affected by CVE-2024-53678?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST