CVE-2024-52057

The vulnerability results from improper neutralization of special characters in SQL queries in the Queuing Service component. A remote unauthenticated attacker can inject malicious SQL commands into queries directed to the database. This requires certain technical conditions to be met on the environment side (AT:P in the CVSS vector), but does not require any user interaction.

A successful attack allows unauthorized reading and modification of data stored in the RTI Connext Professional system database. This can lead to disclosure of sensitive information and compromise of data integrity processed by the system.

RTI Connext Professional should be updated to version 7.3.0 or newer (for the 7.x branch) or to version 6.1.2.17 or newer (for the 6.1.x branch). Users of the 6.0.x and 5.2.x branches should consult with the vendor and apply patches available according to references at https://www.rti.com/vulnerabilities/#cve-2024-52057. It is recommended to limit network access to the Queuing Service only to trusted hosts as a temporary measure.

RTI Connext Professional in versions: from 7.0.0 before 7.3.0, from 6.1.0 before 6.1.2.17, from 6.0.0 before 6.0.* (all versions of the 6.0.x branch), from 5.2.0 before 5.3.* (all versions of the 5.2.x branch).