What is GHSA-2rvx-cvfc-mcp2?

GHSA-2rvx-cvfc-mcp2 is a security advisory published by GitHub Security Advisories with Critical severity. New Relic .NET Agent contains SQL Injection

Which CVE IDs does GHSA-2rvx-cvfc-mcp2 cover?

GHSA-2rvx-cvfc-mcp2 covers the following CVE IDs: CVE-2017-9246. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2rvx-cvfc-mcp2?

GHSA-2rvx-cvfc-mcp2 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-2rvx-cvfc-mcp2?

GHSA-2rvx-cvfc-mcp2 affects 1 product, including: nuget/NewRelic.Agent:\u003c 6.3.123.0.

GHSA-2rvx-cvfc-mcp2CriticalCVSS 9.8

New Relic .NET Agent contains SQL Injection

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

October 24, 2023

🔗 CVE IDs covered (1)

CVE-2017-9246 →

📋 Description

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLAN_ALL ON protection mechanism.

🎯 Affected products1

nuget/NewRelic.Agent:< 6.3.123.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2017-9246
https://web.archive.org/web/20221202191459/https://blog.seanmcelroy.com/2017/05/26/sql-injection-with-new-relic-patched/
https://github.com/advisories/GHSA-2rvx-cvfc-mcp2