9.8crit
CVE-2017-9246
New Relic .NET Agent contains SQL Injection
Also known as GHSA-2rvx-cvfc-mcp2
Published 9 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 68%
Public exploits
0
none known
Summary
New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLAN_ALL ON protection mechanism.
Exploit prediction (EPSS)
1.19% probability of exploitation in the next 30 days, higher than 68% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | NewRelic.Agent | <6.3.123.0 | 6.3.123.0 |
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- blog.seanmcelroy.com /2017/05/26/sql-injection-with-new-relic-patched/ · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-9246 · advisory
- github.com /newrelic/newrelic-dotnet-agent · package
- web.archive.org /web/20221202191459/https://blog.seanmcelroy.com/2017/05/26/sql-injection-with-new-relic-p · web
Sources
- CVE List: CVE-2017-9246
- GitHub Advisory: GHSA-2rvx-cvfc-mcp2
- NVD: CVE-2017-9246
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.