What is CVE-2017-9246?

CVE-2017-9246 is a critical-severity vulnerability in Newrelic .Net Agent, classified under SQL Injection. CVSS score: 9.8/10. Published 2017-06-13.

How severe is CVE-2017-9246?

Critical severity. CVSS v3 base score is 9.8 out of 10.

SQL Injection in Newrelic .Net Agent

CVE-2017-9246

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLAN_ALL ON protection mechanism.

Vulnerability class: SQL Injection

EPSS: 0.012 (64.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Newrelic .Net_agent
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-9246?: CVE-2017-9246 is a critical-severity vulnerability in Newrelic .Net Agent, classified under SQL Injection. CVSS score: 9.8/10. Published 2017-06-13.
How severe is CVE-2017-9246?: Critical severity. CVSS v3 base score is 9.8 out of 10.