High severity · published Nov 7, 2024
CVE-2024-45794
SQL Injection in CreateUser API in devtron
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
devtron · devtron-labs
< 0.7.2 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45794
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45794
Exploit
https://github.com/devtron-labs/devtron/security/advisories/GHSA-q78v-cv36-8fxj
More from devtron
8.8
CVE-2026-82882
Devtron through 2.2.0 Missing Authorization via webhook API token endpoint
8.8
CVE-2026-25538
Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage