« Volver al listado

CVE-2024-9678

Estado: AplazadaMedia (4.9)—

An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arbitrary SQL queries potentially leading to command execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

DLP Extension — DLP ExtensionAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-9678",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-9678",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-16T16:32:25.446384Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "trellixpsirt@trellix.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "trellixpsirt@trellix.com",
      "affectedData": [
        {
          "vendor": "Trellix",
          "product": "DLP Extension",
          "versions": [
            {
              "status": "affected",
              "version": "11.11.1.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-16T07:15:06.917",
  "references": [
    {
      "url": "https://thrive.trellix.com/s/article/000013964",
      "source": "trellixpsirt@trellix.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "trellixpsirt@trellix.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An SQL Injection vulnerability existed in DLP Extension 11.11.1.3.  The vulnerability allowed an attacker to perform arbitrary SQL queries potentially leading to command execution."
    },
    {
      "lang": "es",
      "value": "En DLP Extension 11.11.1.3 existía una vulnerabilidad de inyección SQL que permitía a un atacante realizar consultas SQL arbitrarias que podían derivar en la ejecución de comandos."
    }
  ],
  "lastModified": "2026-06-17T08:25:02.690",
  "sourceIdentifier": "trellixpsirt@trellix.com"
}