Vulnerability Details CVE-2024-24213
Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically, /pg_meta/default/query is for SQL queries that are entered in an intended UI by an authorized user. Nothing is injected.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 71.6%
CVSS Severity
CVSS v3 Score 9.8
References
- https://app.flows.sh:8443/project/default%2C
- https://github.com/940198871/Vulnerability-details/blob/main/CVE-2024-24213
- https://postfixadmin.ballardini.com.ar:8443/project/default/logs/explorer.
- https://reference1.example.com/project/default/logs/explorer%2C
- https://supabase.com/docs/guides/database/overview#the-sql-editor
- https://app.flows.sh:8443/project/default%2C
- https://github.com/940198871/Vulnerability-details/blob/main/CVE-2024-24213
- https://postfixadmin.ballardini.com.ar:8443/project/default/logs/explorer.
- https://reference1.example.com/project/default/logs/explorer%2C
- https://supabase.com/docs/guides/database/overview#the-sql-editor