CVE-2024-9194
Last modified
CVE-2024-9194 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Linux allows SQL Injection.This issue affects Octopus Server: from 2024.1.0 before 2024.1.13038, from 2024.2.0 before 2024.2.9482, from 2024.3.0 before 2024.3.12766.. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Linux allows SQL Injection.This issue affects Octopus Server: from 2024.1.0 before 2024.1.13038, from 2024.2.0 before 2024.2.9482, from 2024.3.0 before 2024.3.12766.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Octopus | Octopus Server | >= 2024.1.437, < 2024.1.13038 |
| Octopus | Octopus Server | >= 2024.2.101, < 2024.2.9482 |
| Octopus | Octopus Server | >= 2024.3.164, < 2024.3.12766 |
References
- https://advisories.octopus.com/post/2024/sa2024-09/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-9194?
How severe is CVE-2024-9194?
How do I fix CVE-2024-9194?
Are you affected by CVE-2024-9194?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST