Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically, /pg_meta/default/query is for SQL queries that are entered in an intended UI by an authorized user. Nothing is injected.
References
| Link | Resource |
|---|---|
| https://app.flows.sh:8443/project/default%2C | Broken Link |
| https://github.com/940198871/Vulnerability-details/blob/main/CVE-2024-24213 | Third Party Advisory |
| https://postfixadmin.ballardini.com.ar:8443/project/default/logs/explorer. | Broken Link |
| https://reference1.example.com/project/default/logs/explorer%2C | Broken Link |
| https://supabase.com/docs/guides/database/overview#the-sql-editor | Vendor Advisory |
Configurations
History
21 Aug 2024, 18:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://supabase.com/docs/guides/database/overview#the-sql-editor - Vendor Advisory | |
| CPE | cpe:2.3:a:supabase:postgres:15.1:*:*:*:*:*:*:* | |
| First Time |
Supabase postgres
Supabase |
05 Mar 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically, /pg_meta/default/query is for SQL queries that are entered in an intended UI by an authorized user. Nothing is injected. | |
| References |
|
15 Feb 2024, 16:00
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Postgresql
Postgresql postgresql |
|
| CPE | cpe:2.3:a:postgresql:postgresql:15.1:*:*:*:*:*:*:* | |
| CWE | CWE-89 | |
| References | () https://app.flows.sh:8443/project/default%2C - Broken Link | |
| References | () https://postfixadmin.ballardini.com.ar:8443/project/default/logs/explorer. - Broken Link | |
| References | () https://github.com/940198871/Vulnerability-details/blob/main/CVE-2024-24213 - Third Party Advisory | |
| References | () https://reference1.example.com/project/default/logs/explorer%2C - Broken Link |
08 Feb 2024, 18:42
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-08 18:15
Updated : 2024-08-21 18:06
NVD link : CVE-2024-24213
Mitre link : CVE-2024-24213
CVE.ORG link : CVE-2024-24213
JSON object : View
Products Affected
supabase
- postgres
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')