SQL Injection in Apache Vcl
CVE-2024-53678
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when requesting a new Block Allocation such that a SELECT SQL statement is modified. The data returned by the SELECT statement is not viewable by the attacker. This issue affects all versions of Apache VCL from 2.2 through 2.5.1. Users are recommended to upgrade to version 2.5.2, which fixes the issue.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (47.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 47.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Apache Vcl
- Apache Software Foundation Vcl — versions 2.2
Weakness classification (CWE)
References
- lists.apache.org/thread/2bmjnzgjwwq59nv6xw44w0tnpz4k4pf4 (vendor-advisory, Mailing List, Issue Tracking, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-53678?
- CVE-2024-53678 is a high-severity vulnerability in Apache Vcl, classified under SQL Injection. CVSS score: 8.8/10. Published 2025-03-25.
- How severe is CVE-2024-53678?
- High severity. CVSS v3 base score is 8.8 out of 10.