CVE-2024-53678

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-53678
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when requesting a new Block Allocation such that a SELECT SQL statement is modified. The data returned by the SELECT statement is not viewable by the attacker. This issue affects all versions of Apache VCL from 2.2 through 2.5.1. Users are recommended to upgrade to version 2.5.2, which fixes the issue.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/2bmjnzgjwwq59nv6xw44w0tnpz4k4pf4 Mailing List Vendor Advisory Issue Tracking
http://www.openwall.com/lists/oss-security/2025/03/24/1 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:vcl:*:*:*:*:*:*:*:*
History

14 Jul 2025, 18:06

Type Values Removed Values Added
CPE cpe:2.3:a:apache:vcl:*:*:*:*:*:*:*:*
First Time Apache vcl
Apache
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References () https://lists.apache.org/thread/2bmjnzgjwwq59nv6xw44w0tnpz4k4pf4 - () https://lists.apache.org/thread/2bmjnzgjwwq59nv6xw44w0tnpz4k4pf4 - Mailing List, Vendor Advisory, Issue Tracking
References () http://www.openwall.com/lists/oss-security/2025/03/24/1 - () http://www.openwall.com/lists/oss-security/2025/03/24/1 - Mailing List, Third Party Advisory

27 Mar 2025, 16:45

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de neutralización incorrecta de elementos especiales en una instrucción SQL ('Inyección SQL') en Apache VCL. Los usuarios pueden modificar los datos del formulario enviado al solicitar una nueva asignación de bloque, modificando así una sentencia SQL SELECT. El atacante no puede ver los datos devueltos por la sentencia SELECT. Este problema afecta a todas las versiones de Apache VCL, desde la 2.2 hasta la 2.5.1. Se recomienda actualizar a la versión 2.5.2, que soluciona el problema.

25 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-25 10:15

Updated : 2025-07-14 18:06

NVD link : CVE-2024-53678

Mitre link : CVE-2024-53678

CVE.ORG link : CVE-2024-53678

JSON object : View

Products Affected

apache

  • vcl
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')