Vulnerability · Published Nov 7, 2024 · Assigned by GitHub_M

CVE-2024-45794SQL Injection in CreateUser API in devtron

High 8.3

In plain English

A high-severity SQL injection in devtron from devtron-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.7%top 44.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/devtron-labs/devtron	0.7.2	GHSA-q78v-cv36-8fxj
Go	github.com/devtron-labs/devtron	0.7.2	GO-2024-3260

Affected products (as reported)

Vendor	Product	Versions
devtron-labs	devtron	< 0.7.2

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

https://github.com/devtron-labs/devtron/security/advisories/GHSA-q78v-cv36-8fxj x_refsource_CONFIRM