Lucene search

K
redhatcveRedhat.comRH:CVE-2024-36039
HistoryMay 23, 2024 - 7:21 p.m.

CVE-2024-36039

2024-05-2319:21:13
redhat.com
access.redhat.com
6
pymysql
sql injection
json input
input sanitization
data access
data tampering
remote code execution

7.6 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

A SQL injection vulnerability was found in PyMySQL when used with untrusted JSON input, as keys are not properly escaped by escape_dict. This flaw allows attackers to inject malicious SQL queries by exploiting the insufficient input sanitization in PyMySQL when processing JSON data. Successful exploitation of this vulnerability can result in unauthorized data access, data tampering, or potentially remote code execution on the backend database server, depending on the permissions granted to the database user.

7.6 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%