CVE-2024-12744CWE-89

SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31

High · published December 24, 2024

CVSS v4.0
8.6
EPSS
1%
Percentile
47.3
In the wild
Unconfirmed
What it is

A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00587 · 47.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-12-24T16:12Z
EPSS history
Timeline
  • 24 DEC 16:12Z
    SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31
    cvelistv5