Description
Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically, /pg_meta/default/query is for SQL queries that are entered in an intended UI by an authorized user. Nothing is injected.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://app.flows.sh:8443/project/default%2C ↗
- https://reference1.example.com/project/default/logs/explorer%2C ↗
- https://postfixadmin.ballardini.com.ar:8443/project/default/logs/explorer. ↗
- https://github.com/940198871/Vulnerability-details/blob/main/CVE-2024-24213 ↗
- https://supabase.com/docs/guides/database/overview#the-sql-editor ↗