CVE-2024-58369

EUVD-2024-55685
SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clients can invoke these entities at unsupported levels to crash the SurrealDB server, resulting in denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 37.54%
Affected Products (NVD)
VendorProductVersion
surrealdbsurrealdb
𝑥
< 1.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jm4v-58r5-66hj
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-global-parameters