What is CVE-2024-45794?

CVE-2024-45794 is a high-severity vulnerability in Devtron, classified under SQL Injection. CVSS score: 8.3/10. Published 2024-11-07.

How severe is CVE-2024-45794?

High severity. CVSS v3 base score is 8.3 out of 10.

SQL Injection in Devtron

CVE-2024-45794

devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerability class: SQL Injection

EPSS: 0.007 (51.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.

Affected products

Devtron
Devtron-labs Devtron — versions < 0.7.2

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2024-45794?: CVE-2024-45794 is a high-severity vulnerability in Devtron, classified under SQL Injection. CVSS score: 8.3/10. Published 2024-11-07.
How severe is CVE-2024-45794?: High severity. CVSS v3 base score is 8.3 out of 10.