critical9.8
CVE-2024-55586
Withdrawn Advisory: Nette Database SQL injection
Impact
## Withdrawn Advisory This advisory has been withdrawn as it was reported in error. This link is maintained to preserve external references. ## Original Description Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | nette/database | <= 3.2.4 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| Nette Database | through 3.2.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/CSIRTTrizna/CVE-2024-55586
- https://github.com/nette/database/releases
- https://www.csirt.sk/nette-framework-vulnerability-permits-sql-injection.html
- https://github.com/advisories/GHSA-f626-677r-j5vq
- https://nvd.nist.gov/vuln/detail/CVE-2024-55586
- https://github.com/github/advisory-database/pull/5079#issuecomment-2552932977