CVE-2024-57587

co2scope vulnerability - easyvirt

Critical CVSS Score: 9.1 Published: 2025-01-31

Description

Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to /api/auth/login.

Affected Systems

Vendor easyvirt
Product co2scope
Affected Versions through 1.3.0; through 8.6.0
CWE ID CWE-89

Mitigation

Apply the latest security patches from the vendor, restrict network exposure where applicable, and monitor for exploitation attempts.

Fix Instructions

Refer to the vendor advisory and apply the latest security updates. See references for detailed patching instructions.

References

Risk Assessment

CVSS: 9.1/10

Exploit Available Unknown
Patch Available Unknown

Need Help Patching?

Our security team can help assess and remediate this vulnerability in your environment.

Get Help

Related Vulnerabilities

high

CVE-2024-53355

co2scope...
critical

CVE-2024-55062

co2scope...
critical

CVE-2024-53356

co2scope...

Stay Ahead of Threats

Subscribe to our vulnerability feed and get instant alerts when new CVEs affect your systems.

Start Monitoring