CVE-2024-24811 json
Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution
published 2024-02-07 2 y ago modified 2026-09-10 1 mo ago also GHSA-r3jc-3qmm-w3pw , PYSEC-2026-489 , EUVD-2024-0707
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.
Patch / fix
- pypi products-sqlalchemyda 2.2
- zope sqlalchemyda 2.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | products-sqlalchemyda | <2.2 |
2.2 |
Affected products
- zopefoundation Products.SQLAlchemyDA
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a
web, patch
-
github.com
/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-24811
advisory
-
github.com
/zopefoundation/Products.SQLAlchemyDA
package
-
pypi.org
/project/products-sqlalchemyda
package
-
github.com
/advisories/GHSA-r3jc-3qmm-w3pw
advisory
Sources
- CVE List CVE-2024-24811
- GitHub Advisory GHSA-r3jc-3qmm-w3pw
- NVD CVE-2024-24811
- OSV PYSEC-2026-489
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.