CVE-2024-8503 (GCVE-0-2024-8503)
Vulnerability from cvelistv5 – Published: 2024-09-10 19:22 – Updated: 2025-11-04 16:16
VLAI?
Summary
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
Severity ?
9.8 (Critical)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Credits
Jaggar Henry of KoreLogic, Inc.
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:vicidial:vicidial:2.14-917a:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vicidial",
"vendor": "vicidial",
"versions": [
{
"status": "affected",
"version": "2.14-917a"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-8503",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T19:30:58.340394Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-10T19:36:08.120Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T16:16:05.997Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Sep/25"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Sep/26"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "VICIdial",
"vendor": "VICIdial",
"versions": [
{
"status": "affected",
"version": "2.14-917a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jaggar Henry of KoreLogic, Inc."
}
],
"datePublic": "2024-09-10T19:22:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database."
}
],
"value": "An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-10T19:22:40.111Z",
"orgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
"shortName": "KoreLogic"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt"
},
{
"tags": [
"product"
],
"url": "https://www.vicidial.org/vicidial.php"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue has been remediated in the public svn/trunk codebase, as of revision 3848 committed 2024-07-08.\u003cbr\u003e"
}
],
"value": "This issue has been remediated in the public svn/trunk codebase, as of revision 3848 committed 2024-07-08."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VICIdial Unauthenticated SQL Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
"assignerShortName": "KoreLogic",
"cveId": "CVE-2024-8503",
"datePublished": "2024-09-10T19:22:40.111Z",
"dateReserved": "2024-09-05T21:29:03.299Z",
"dateUpdated": "2025-11-04T16:16:05.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.\"}, {\"lang\": \"es\", \"value\": \"Un atacante no autenticado puede aprovechar una vulnerabilidad de inyecci\\u00f3n SQL basada en tiempo en VICIdial para enumerar registros de la base de datos. De manera predeterminada, VICIdial almacena credenciales de texto plano dentro de la base de datos.\"}]",
"id": "CVE-2024-8503",
"lastModified": "2024-11-21T09:53:17.257",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
"published": "2024-09-10T20:15:05.283",
"references": "[{\"url\": \"https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt\", \"source\": \"bbf0bd87-ece2-41be-b873-96928ee8fab9\"}, {\"url\": \"https://www.vicidial.org/vicidial.php\", \"source\": \"bbf0bd87-ece2-41be-b873-96928ee8fab9\"}, {\"url\": \"http://seclists.org/fulldisclosure/2024/Sep/25\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"bbf0bd87-ece2-41be-b873-96928ee8fab9\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-89\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-8503\",\"sourceIdentifier\":\"bbf0bd87-ece2-41be-b873-96928ee8fab9\",\"published\":\"2024-09-10T20:15:05.283\",\"lastModified\":\"2025-11-04T17:16:17.750\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.\"},{\"lang\":\"es\",\"value\":\"Un atacante no autenticado puede aprovechar una vulnerabilidad de inyecci\u00f3n SQL basada en tiempo en VICIdial para enumerar registros de la base de datos. De manera predeterminada, VICIdial almacena credenciales de texto plano dentro de la base de datos.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"bbf0bd87-ece2-41be-b873-96928ee8fab9\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"references\":[{\"url\":\"https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt\",\"source\":\"bbf0bd87-ece2-41be-b873-96928ee8fab9\"},{\"url\":\"https://www.vicidial.org/vicidial.php\",\"source\":\"bbf0bd87-ece2-41be-b873-96928ee8fab9\"},{\"url\":\"http://seclists.org/fulldisclosure/2024/Sep/25\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/fulldisclosure/2024/Sep/26\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://seclists.org/fulldisclosure/2024/Sep/25\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-09-10T21:02:45.121Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-8503\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T19:30:58.340394Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:vicidial:vicidial:2.14-917a:*:*:*:*:*:*:*\"], \"vendor\": \"vicidial\", \"product\": \"vicidial\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.14-917a\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-10T19:35:47.224Z\"}}], \"cna\": {\"title\": \"VICIdial Unauthenticated SQL Injection\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jaggar Henry of KoreLogic, Inc.\"}], \"affected\": [{\"vendor\": \"VICIdial\", \"product\": \"VICIdial\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.14-917a\"}], \"platforms\": [\"Linux\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"This issue has been remediated in the public svn/trunk codebase, as of revision 3848 committed 2024-07-08.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"This issue has been remediated in the public svn/trunk codebase, as of revision 3848 committed 2024-07-08.\u003cbr\u003e\", \"base64\": false}]}], \"datePublic\": \"2024-09-10T19:22:00.000Z\", \"references\": [{\"url\": \"https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://www.vicidial.org/vicidial.php\", \"tags\": [\"product\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"bbf0bd87-ece2-41be-b873-96928ee8fab9\", \"shortName\": \"KoreLogic\", \"dateUpdated\": \"2024-09-10T19:22:40.111Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-8503\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-10T21:02:45.121Z\", \"dateReserved\": \"2024-09-05T21:29:03.299Z\", \"assignerOrgId\": \"bbf0bd87-ece2-41be-b873-96928ee8fab9\", \"datePublished\": \"2024-09-10T19:22:40.111Z\", \"assignerShortName\": \"KoreLogic\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…