SQL Injection in Apache Vcl
CVE-2024-53678
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when requesting a new Block Allocation such that a SELECT SQL statement is modified. The data returned by the SELECT statement is not viewable by the attacker. This issue affects all versions of Apache VCL from 2.2 through 2.5.1. Users are recommended to upgrade to version 2.5.2, which fixes the issue.
Vulnerability class: SQL Injection
EPSS: 0.006 (43.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Vcl
- Apache Software Foundation Vcl — versions 2.2
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Mailing List, Issue Tracking, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-53678?
- CVE-2024-53678 is a high-severity vulnerability in Apache Vcl, classified under SQL Injection. CVSS score: 8.8/10. Published 2025-03-25.
- How severe is CVE-2024-53678?
- High severity. CVSS v3 base score is 8.8 out of 10.