CVE-2024-44906

Aliases:GHSA-h4h6-vccr-44h2GO-2025-3765
Advisory lineage Upstream: 0 Downstream: 2
Modified
Published: 12 Jun 2025, 00:00
Last modified:13 Aug 2025, 13:57

Vulnerability Summary

Overall Risk (default)
medium
36/100
CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.22% LOW
0% probability +0.18%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

12 Jun 2025, 00:00
Published
Vulnerability first disclosed
13 Aug 2025, 13:57
Last Modified
Vulnerability information updated

Description

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.22%• Percentile: 45%

Techniques & Countermeasures

  • CWE-89•Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

    The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected Systems

  • github.com/uptrace/bun/driver•pgdriver

    < 1.2.15

  • uptrace•pgdriver

    1.2.1

References (11)