CVE-2024-53678: Apache VCL: SQL injection vulnerability in New Block Allocation form
First published: Mon Mar 24 2025(Updated: )
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when requesting a new Block Allocation such that a SELECT SQL statement is modified. The data returned by the SELECT statement is not viewable by the attacker. This issue affects all versions of Apache VCL from 2.2 through 2.5.1. Users are recommended to upgrade to version 2.5.2, which fixes the issue.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Virtual Computing Lab | >=2.2<2.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-53678?
The severity of CVE-2024-53678 is rated as critical due to its potential for SQL injection attacks.
How do I fix CVE-2024-53678?
To fix CVE-2024-53678, upgrade Apache VCL to version 2.5.1 or later.
What types of vulnerabilities does CVE-2024-53678 represent?
CVE-2024-53678 represents SQL injection vulnerabilities that allow attackers to manipulate SQL queries executed by the application.
Who is affected by CVE-2024-53678?
Organizations using Apache VCL versions 2.2 through 2.5.1 are affected by CVE-2024-53678.
What actions should I take if my system is vulnerable to CVE-2024-53678?
If your system is vulnerable to CVE-2024-53678, immediately patch or upgrade to a secure version and review access logs for potential exploitation.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-53678
- agent/title
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/source
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/type
- agent/description
- agent/trending
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/apache
- canonical/apache virtual computing lab