id: GO-2024-2981
modules:
    - module: github.com/openclarity/kubeclarity/backend
      versions:
        - fixed: 0.0.0-20240711173334-1d1178840703
summary: SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend
cves:
    - CVE-2024-39909
ghsas:
    - GHSA-5248-h45p-9pgw
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-39909
    - web: https://github.com/openclarity/kubeclarity/blob/main/backend/pkg/database/id_view.go#L79
    - web: https://github.com/openclarity/kubeclarity/commit/1d1178840703a72d9082b7fc4aea0a3326c5d294
notes:
    - fix: 'github.com/openclarity/kubeclarity/backend: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
source:
    id: GHSA-5248-h45p-9pgw
    created: 2024-08-16T16:55:23.63598-04:00
review_status: UNREVIEWED