CVE-2024-24213: SQL Injection

Published Feb 8, 2024

Updated

Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pgmeta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically, /pgmeta/default/query is for SQL queries that are entered in an intended UI by an authorized user. Nothing is injected.

Affected Software

1 affected component

Supabase PostgreS=15.1

Event History

Feb 8, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-24213?

CVE-2024-24213 is classified as a SQL injection vulnerability affecting Supabase PostgreSQL v15.1.

How do I fix CVE-2024-24213?

To mitigate CVE-2024-24213, review and sanitize user inputs in the affected /pg_meta/default/query component.

Which versions of Supabase PostgreSQL are affected by CVE-2024-24213?

CVE-2024-24213 specifically affects Supabase PostgreSQL version 15.1.

Is CVE-2024-24213 an intended feature or a security flaw?

The vendor has stated that CVE-2024-24213 is intended behavior, which complicates the vulnerability's classification as a flaw.

What component is tied to CVE-2024-24213?

CVE-2024-24213 is linked to the /pg_meta/default/query component within Supabase.