CVE-2024-39368

Vulnerability

Intel Neural Compressor software prior to version 3.0 contains a SQL injection vulnerability due to improper neutralization of special elements used in SQL commands [1]. This flaw allows an authenticated user to inject arbitrary SQL queries into the application's database operations.

Exploitation

An attacker must be authenticated and have adjacent network access (e.g., same broadcast domain) to exploit this vulnerability [1]. No additional privileges beyond standard authentication are required. The injection occurs when user-supplied input is incorporated into SQL statements without proper sanitization.

Impact

Successful exploitation could lead to escalation of privilege, potentially enabling the attacker to gain higher-level access or perform unauthorized actions within the Intel Neural Compressor environment [1]. This could compromise the confidentiality, integrity, or availability of the affected system.

Mitigation

Intel has addressed this vulnerability in version 3.0 of Neural Compressor [1]. Users are strongly advised to update to the latest version to mitigate the risk. No workarounds are currently available.