Medium severity · published Dec 16, 2024
CVE-2024-9678
An SQL Injection vulnerability existed in DLP Extension 11.11.1.3
4.9
CVSS
0.8%
EPSS
No
On KEV
Description
An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arbitrary SQL queries potentially leading to command execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
DLP Extension · Trellix
11.11.1.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9678
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9678
thrive.trellix.com
https://thrive.trellix.com/s/article/000013964
More from DLP Extension
5.3
CVE-2024-9679
A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user credentials