High severity · published Dec 24, 2024
CVE-2024-12746
SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0
8.0
CVSS
0.5%
EPSS
No
On KEV
Description
A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 (Windows or Linux) allows a user to gain escalated privileges via the SQLTables or SQLColumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.6.0 or revert to driver version 2.1.4.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Amazon Redshift ODBC Driver · Amazon
2.1.5.0 · source: vendor
RO
Redshift Odbc Driver · Amazon
2.1.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12746
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12746
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2024-015/
Release Notes
https://github.com/aws/amazon-redshift-odbc-driver/releases/tag/v2.1.6
Vendor Advisory
https://github.com/aws/amazon-redshift-odbc-driver/security/advisories/GHSA-g63m-5vjv-wr3v