Vulnerability Description
Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2024-54446?
CVE-2024-54446 is a documented vulnerability. Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents....
How severe is CVE-2024-54446?
CVSS scoring is not yet available for CVE-2024-54446. Check NVD for updates.
Is there a patch for CVE-2024-54446?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.