CVE-2024-52057

Potential arbitrary SQL query execution in Queuing Service while parsing malicious remote commands or configuration files

State: Published
Severity: 9.1 Critical
Published: Dec 13, 2024
Updated: Feb 7, 2025
Reserved: Nov 5, 2024

Read the record on cve.org

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Professional (Queuing Service) allows SQL Injection.This issue affects Connext Professional: from 7.0.0 before 7.3.0, from 6.1.0 before 6.1.2.17, from 6.0.0 before 6.0.*, from 5.2.0 before 5.3.*.

Scores

CVSS	Score	Vector	Source
4.0	9.1 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	RTI

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Connext ProfessionalRTI	7.0.0 to before 7.3.0Affected 5.2.0 to before 6.1.2.17Affected

References

https://www.rti.com/vulnerabilities/#cve-2024-52057

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.