CVE-2024-33276

2024-04-2900:00:00

mitre

www.cve.org

cve-2024-33276

sql injection

fme modules

preorderandnotication

remote attacker

arbitrary sql commands

preordermodel

getidproductattributesbyidattributes

8.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a remote attacker to run arbitrary SQL commands via the PreorderModel::getIdProductAttributesByIdAttributes() method.

References

security.friendsofpresta.org/modules/2024/04/25/preorderandnotification.html