CVE-2024-7552

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-7552
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7552.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-7552
Published
2024-08-06T14:31:09.110Z
Modified
2026-07-15T01:49:19.059592003Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
DataGear Data Schema Page ConversionSqlParamValueMapper.java evaluateVariableExpression expression language injection
Details

A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression of the file ConversionSqlParamValueMapper.java of the component Data Schema Page. The manipulation leads to improper neutralization of special elements used in an expression language statement. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273697 was assigned to this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-917"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7552.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "5.0"
                },
                {
                    "last_affected": "5.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/datageartech/datagear

Affected ranges

Type
GIT
Repo
https://github.com/datageartech/datagear
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a6f3c241f9f562428402568336119ca5b86e0d2a
Database specific 
{
    "cpe": "cpe:2.3:a:datagear:datagear:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.0.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v1.*
v1.1.0
v1.1.1
v1.10.0
v1.11.0
v1.11.1
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.7.0
v1.8.0
v1.8.1
v1.9.0
v2.*
v2.0.0
v2.1.1
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v2.7.0
v2.8.0
v2.9.0
v3.*
v3.0.0
v3.1.0
v3.2.0
v4.*
v4.0.0
v4.1.0
v4.1.1
v4.2.0
v4.3.0
v4.3.1
v4.4.0
v4.5.0
v4.5.1
v4.6.0
v4.7.0
v5.*
v5.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7552.json"