CVE-2024-55551

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-471

Affected software

Vendor	Product	Versions
Exasol	JDBC driver	< 24.2.1

References

https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htmRelease Notes
https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htmProduct
https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0fThird Party Advisory
https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179Technical Description

Timeline

Published: Mar 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-555537.5In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the inte CVE-2024-555545.4Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet.CVE-2024-555558.8Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY. This is exacerb CVE-2024-555569.8A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on th CVE-2024-555579.8ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.CVE-2024-55568.8Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module.CVE-2024-555609.8MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installatio CVE-2024-555635.3Bitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913. For example,CVE-2024-555649.8The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow.CVE-2024-555654.3nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.CVE-2024-555666.6ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG). The impact ca CVE-2024-555676.7Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62