What is CVE-2024-49194?

CVE-2024-49194 is a high-severity vulnerability in N/a, classified under Command Injection. CVSS score: 7.3/10. Published 2024-12-17.

How severe is CVE-2024-49194?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2024-49194 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in N/a

CVE-2024-49194

Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connection URL that uses the property krbJAASFile.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.007 (49.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N.

Affected products

N/a — versions n/a

Weakness classification (CWE)

CWE-77 — Command Injection

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

cve@mitre.org

Frequently asked questions

What is CVE-2024-49194?: CVE-2024-49194 is a high-severity vulnerability in N/a, classified under Command Injection. CVSS score: 7.3/10. Published 2024-12-17.
How severe is CVE-2024-49194?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2024-49194 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.