CVE-2024-12744

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12744
A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://aws.amazon.com/security/security-bulletins/AWS-2024-015/ Vendor Advisory
https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-8596-2jgr-ppj7 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:amazon:amazon_web_services_redshift_java_database_connectivity_driver:2.1.0.31:*:*:*:*:*:*:*
History

19 Sep 2025, 14:01

Type Values Removed Values Added
References () https://aws.amazon.com/security/security-bulletins/AWS-2024-015/ - () https://aws.amazon.com/security/security-bulletins/AWS-2024-015/ - Vendor Advisory
References () https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-8596-2jgr-ppj7 - () https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-8596-2jgr-ppj7 - Vendor Advisory
CPE cpe:2.3:a:amazon:amazon_web_services_redshift_java_database_connectivity_driver:2.1.0.31:*:*:*:*:*:*:*
Summary
  • (es) Una inyección de SQL en Amazon Redshift JDBC Driver v2.1.0.31 permite a un usuario obtener privilegios aumentados a través de las API de metadatos getSchemas, getTables o getColumns. Los usuarios deben actualizar a la versión del controlador 2.1.0.32 o volver a la versión del controlador 2.1.0.30.
First Time Amazon amazon Web Services Redshift Java Database Connectivity Driver
Amazon

26 Dec 2024, 15:15

Type Values Removed Values Added
References
  • () https://aws.amazon.com/security/security-bulletins/AWS-2024-015/ -

24 Dec 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-24 17:15

Updated : 2025-09-19 14:01

NVD link : CVE-2024-12744

Mitre link : CVE-2024-12744

CVE.ORG link : CVE-2024-12744

JSON object : View

Products Affected

amazon

  • amazon_web_services_redshift_java_database_connectivity_driver
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')