CVE-2024-55238: SQL Injection
OpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55238?
CVE-2024-55238 is classified as a high severity vulnerability due to the risk of SQL injection that can compromise database security.
How do I fix CVE-2024-55238?
To fix CVE-2024-55238, upgrade OpenMetadata to version 1.4.2 or later, which contains patches for the SQL injection vulnerability.
Who is affected by CVE-2024-55238?
Any instance of OpenMetadata version 1.4.1 or earlier is affected by CVE-2024-55238 and is vulnerable to SQL injection attacks.
What is the impact of exploiting CVE-2024-55238?
Exploiting CVE-2024-55238 allows attackers to execute arbitrary SQL queries, potentially leading to unauthorized data access or data manipulation.
Are there any known exploitations of CVE-2024-55238?
As of now, there are no reported incidents of exploitation of CVE-2024-55238, but the vulnerability is critical and should be mitigated promptly.