CVE-2024-55551

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-55551
An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.
CVSS

No CVSS.

References
Link Resource
https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm Release Notes
https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm Product
https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f Third Party Advisory
https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179 Technical Description
Configurations

Configuration 1 (hide)

cpe:2.3:a:exasol:jdbc_driver:*:*:*:*:*:*:*:*
History

08 Jul 2025, 16:44

Type Values Removed Values Added
References () https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179 - () https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179 - Technical Description
References () https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm - () https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm - Release Notes
References () https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f - () https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f - Third Party Advisory
References () https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm - () https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm - Product
CPE cpe:2.3:a:exasol:jdbc_driver:*:*:*:*:*:*:*:*
First Time Exasol jdbc Driver
Exasol

25 Mar 2025, 17:16

Type Values Removed Values Added
References
  • () https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm -
Summary An issue was discovered in Exasol jdbc driver 24.2.0. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution vulnerability. An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.

19 Mar 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-19 14:15

Updated : 2025-07-08 16:44

NVD link : CVE-2024-55551

Mitre link : CVE-2024-55551

JSON object : View

Products Affected

exasol

  • jdbc_driver
CWE

No CWE.