CVE-2024-32493: SQL Injection
Published Apr 29, 2024
·Updated
An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able to inject SQL in the draft form ID parameter of an AJAX request.
Affected Software
4 affected components
Znuny Znuny LTS>=6.5.1<=6.5.7
Znuny Znuny>=7.0.1<=7.0.16
Znuny Znuny>=6.5.1<=6.5.7
Znuny Znuny>=7.0.1<=7.0.16
Event History
Apr 29, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-32493?
CVE-2024-32493 is considered a high severity vulnerability due to the potential for SQL injection by an authenticated user.
2
How do I fix CVE-2024-32493?
To fix CVE-2024-32493, upgrade Znuny LTS to version 6.5.8 or later, or Znuny to version 7.0.17 or later.
3
What versions are affected by CVE-2024-32493?
CVE-2024-32493 affects Znuny LTS versions 6.5.1 to 6.5.7 and Znuny versions 7.0.1 to 7.0.16.
4
What type of issue is CVE-2024-32493?
CVE-2024-32493 is an SQL injection vulnerability that can be exploited through an AJAX request.
5
Who can exploit CVE-2024-32493?
CVE-2024-32493 can be exploited by any logged-in agent on the affected versions of Znuny and Znuny LTS.