CVE-2024-12746

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 (Windows or Linux) allows a user to gain escalated privileges via the SQLTables or SQLColumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.6.0 or revert to driver version 2.1.4.0.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
AmazonAmazon Redshift ODBC Driver2.1.5.0

References

Timeline

Published
Dec 24, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-127475.6A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behaviCVE-2024-127497.1The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading toCVE-2024-12759.1Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.ThCVE-2024-127504.3The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2024-127517.8Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbiCVE-2024-127527.8Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitCVE-2024-127537.3Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges oCVE-2024-127545.5AnyDesk Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on CVE-2024-127555.4A Cross-Site Scripting (XSS) vulnerability in Avaya Spaces may have allowed unauthorized code execution and potential disclose of sensitive CVE-2024-127566.1An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seeCVE-2024-127578.6Nedap Librix Ecoreader is missing authentication for critical functions that could allow an unauthenticated attacker to potentially execuCVE-2024-12766.4The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St
CVE-2024-12746: High severity, CVSS 8.0 | Vulnix