Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when requesting a new Block Allocation such that a SELECT SQL statement is modified. The data returned by the SELECT statement is not viewable by the attacker.
This issue affects all versions of Apache VCL from 2.2 through 2.5.1.
Users are recommended to upgrade to version 2.5.2, which fixes the issue.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2025/03/24/1 | Mailing List Third Party Advisory |
| https://lists.apache.org/thread/2bmjnzgjwwq59nv6xw44w0tnpz4k4pf4 | Mailing List Vendor Advisory Issue Tracking |
Configurations
History
14 Jul 2025, 18:06
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Apache vcl
Apache |
|
| CPE | cpe:2.3:a:apache:vcl:*:*:*:*:*:*:*:* | |
| References | () http://www.openwall.com/lists/oss-security/2025/03/24/1 - Mailing List, Third Party Advisory | |
| References | () https://lists.apache.org/thread/2bmjnzgjwwq59nv6xw44w0tnpz4k4pf4 - Mailing List, Vendor Advisory, Issue Tracking |
25 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-25 10:15
Updated : 2025-07-14 18:06
NVD link : CVE-2024-53678
Mitre link : CVE-2024-53678
JSON object : View
Products Affected
apache
- vcl
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')