CVE-2024-39909

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean SQL Injection is present in the following resource `/api/applicationResources` via the following parameter `packageID`. As it can be seen in backend/pkg/database/id_view.go, while building the SQL Query the `fmt.Sprintf` function is used to build the query string without the input having first been subjected to any validation. This vulnerability is fixed in 2.23.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
openclarity	kubeclarity	< 2.23.1
openclarity	kubeclarity	< 2.23.1

References

Timeline

Published: Jul 12, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-39915.4The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i CVE-2024-399104.8decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG ed CVE-2024-399119.81Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issu CVE-2024-399125.3web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mecha CVE-2024-399149.8FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was CVE-2024-399159.9Thruk is a multibackend monitoring webinterface for Naemon, Nagios, Icinga and Shinken using the Livestatus API. This authenticated RCE in T CVE-2024-399166.4FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in CVE-2024-399179.8xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of lo CVE-2024-399184.3@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage cachi CVE-2024-399193.1@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage cachi CVE-2024-39924.8The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as ad CVE-2024-399204.3The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection