Every CVE Search/ Get API key

CVE-2024-2097

Authenticated List control client can execute the LINQ query in SCM Server to present event as...

7.5 High

An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.46%Up 0.4 points since Mar 27, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools.

Record
CVE-2024-2097
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2024-27061 7.5

An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools.

Record
EUVD-2024-27061
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-x6rr-6p9v-45m4 7.5

Authenticated List control client can execute the LINQ query in SCM Server to present event as...

Authenticated List control client can execute the LINQ query in SCM Server to present event as list for operator. An authenticated malicious client can send special LINQ query to execute arbitrary code remotely (RCE) on the SCM Server that an attacker otherwise does not have authorization to do.

Record
GHSA-x6rr-6p9v-45m4
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
NVD 7.5

An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools.

Record
CVE-2024-2097
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVALSA-2024:1141 No score

Moderate: mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

Security Fix(es):

  • mysql: InnoDB unspecified vulnerability (CPU Apr 2023) (CVE-2023-21911)
  • mysql: Server: DDL unspecified vulnerability (CPU Apr 2023) (CVE-2023-21919, CVE-2023-21929, CVE-2023-21933)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21920, CVE-2023-21935, CVE-2023-21945, CVE-2023-21946, CVE-2023-21976, CVE-2023-21977, CVE-2023-21982)
  • mysql: Server: Components Services unspecified vulnerability (CPU Apr 2023) (CVE-2023-21940, CVE-2023-21947, CVE-2023-21962)
  • mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21953)
  • mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21955)
  • mysql: Server: JSON unspecified vulnerability (CPU Apr 2023) (CVE-2023-21966)
  • mysql: Server: DML unspecified vulnerability (CPU Apr 2023) (CVE-2023-21972)
  • mysql: Client programs unspecified vulnerability (CPU Apr 2023) (CVE-2023-21980)
  • mysql: Server: Replication unspecified vulnerability (CPU Jul 2023) (CVE-2023-22005, CVE-2023-22007, CVE-2023-22057)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22008)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) (CVE-2023-22032, CVE-2023-22059, CVE-2023-22064, CVE-2023-22065, CVE-2023-22070, CVE-2023-22078, CVE-2023-22079, CVE-2023-22092, CVE-2023-22103, CVE-2023-22110, CVE-2023-22112)
  • mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22033)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2023) (CVE-2023-22046)
  • mysql: Client programs unspecified vulnerability (CPU Jul 2023) (CVE-2023-22053, CVE-2023-22054, CVE-2023-22056)
  • mysql: Server: DDL unspecified vulnerability (CPU Jul 2023) (CVE-2023-22058)
  • mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22066, CVE-2023-22068, CVE-2023-22084, CVE-2023-22097, CVE-2023-22104, CVE-2023-22114)
  • mysql: Server: UDF unspecified vulnerability (CPU Oct 2023) (CVE-2023-22111)
  • mysql: Server: DML unspecified vulnerability (CPU Oct 2023) (CVE-2023-22115)
  • mysql: Server: RAPID unspecified vulnerability (CPU Jan 2024) (CVE-2024-20960)
  • mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2024) (CVE-2024-20961, CVE-2024-20962, CVE-2024-20965, CVE-2024-20966, CVE-2024-2097, CVE-2024-20971, CVE-2024-20972, CVE-2024-20973, CVE-2024-20974, CVE-2024-20976, CVE-2024-20977, CVE-2024-20978, CVE-2024-20982)
  • mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2024) (CVE-2024-20963)
  • mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2024) (CVE-2024-20964)
  • mysql: Server: Replication unspecified vulnerability (CPU Jan 2024) (CVE-2024-20967)
  • mysql: Server: Options unspecified vulnerability (CPU Jan 2024) (CVE-2024-20968)
  • mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20969)
  • mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20981)
  • mysql: Server: DML unspecified vulnerability (CPU Jan 2024) (CVE-2024-20983)
  • mysql: Server : Security : Firewall unspecified vulnerability (CPU Jan 2024) (CVE-2024-20984)
  • mysql: Server: UDF unspecified vulnerability (CPU Jan 2024) (CVE-2024-20985)
  • zstd: mysql: buffer overrun in util.c (CVE-2022-4899)
  • mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2023) (CVE-2023-22038)
  • mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2023) (CVE-2023-22048)
  • mysql: Server: Security: Encryption unspecified vulnerability (CPU Oct 2023) (CVE-2023-22113)

Bug Fix(es):

  • Fix for MySQL bug #33630199 in 8.0.32 introduces regression when --set-gtid-purged=OFF (AlmaLinux-22454)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:1141
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mysql
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-common
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-devel
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-errmsg
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-libs
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-server
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3
mysql-test
AlmaLinux:9
From an advisory covering 76 CVEs
 before 8.0.36-1.el9_3
8.0.36-1.el9_3

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-2097 is a high vulnerability (CVSS 7.5) in Hitachi Energy Mach Scm Server, published March 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. No source names a fixed version.

References

Show 149 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open