CVE-2024-40120: seaweedfs SQL Injection
CVSS: 6.5v3.1MediumAnalyzed
AliasesGHSA-q97m-8853-pq76BIT-seaweedfs-2024-40120GO-2025-3690CGA-29x3-rwj9-2f66CGA-4jf4-6mcp-544rCGA-f9rg-cxx6-vc7fCGA-jmfc-xh37-q2hx
Published 16-05-2025Last modified 16-05-2025
Vulnerability summary
CVE-2024-40120 is a medium (CVSS 6.5) SQL Injection vulnerability in seaweedfs. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.26%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2github
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 16-05-2025PublishedVulnerability first disclosed.
- 16-05-2025Last modifiedVulnerability information updated.
Description
seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_store.go.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NSourcesAll 4 agree
- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
+0.01 pp
From 0.25% on 19-09-2026
19-09-202619-10-2026
EPSS score0.26%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundSeaweedfs
Maturity: poc
1B2115C1D644Bd3Db1C1B3F16684A78C
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- seaweedfs-operator< 1.0.6-r0
- seaweedfs-operator-fips< 1.0.6-r0
Github.com/seaweedfs1 product
- seaweedfs< 0.0.0-20240625155419-9ac102336200
Seaweedfs1 product
- seaweedfs3.68
3 vendors · 4 products
