CVE-2024-44905

Aliases:GHSA-6xp3-p59p-q4fjGO-2025-3764
Advisory lineage Upstream: 0 Downstream: 5
Analyzed
Published: 12 Jun 2025, 00:00
Last modified:17 Jun 2025, 19:10

Vulnerability Summary

Overall Risk (default)
medium
36/100
CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.2% LOW
0% probability +0.16%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

12 Jun 2025, 00:00
Published
Vulnerability first disclosed
17 Jun 2025, 19:10
Last Modified
Vulnerability information updated

Description

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.20%• Percentile: 42%

Techniques & Countermeasures

  • CWE-89•Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

    The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected Systems

  • github.com/go-pg•pg

    ≤ 8.0.7 | all

  • github.com/go-pg/pg•v10

    < 10.15.0

  • github.com/go-pg/pg•v9

    ≤ 9.2.1 | all

  • uptrace•pg

    10.13.0

References (9)