CVE-2024-27112

CRITICAL EPSS 32.7%

Published Sep 11, 20241y ago · Modified Jun 17, 20261w ago

9.3 CVSS 4.0

Critical

Published Sep 11, 2024 1y ago

Last Modified Jun 17, 2026 1w ago

Description

A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database. The vulnerability has been remediated in version 1.52.02.

CVSS Details

Base Score

9.3

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Red

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope N

Threat Intelligence

EPSS Exploit Probability

32.7% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 1

Vendor	Product	Version	Range
soplanning	soplanning	*	<1.52.02

References 1

csirt.divd.nl https://csirt.divd.nl/CVE-2024-27112

Broken Link

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.