Clickhouse
CVE-2019-15024
MEDIUM
Vulnerability Assessment
| Impact | CVSS score of 6.5 (MEDIUM). Attack characteristics: network attack vector, low complexity, low privileges required, no user interaction not required. |
| Exploit ScenarioDerived | This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the medium-severity affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When another replica will fetch data part from the malicious replica, it can force clickhouse-server to write to arbitrary path on filesystem. Affected products include: Clickhouse. Version information: before 19.14.3.
Know when Clickhouse gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionNVD
In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When another replica will fetch data part from the malicious replica, it can force clickhouse-server to write to arbitrary path on filesystem.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
More in Clickhouse
View allRemote code execution is possible in Node.js releases that bundle a vulnerable Brotli decoder: a malformed brotli-compre
Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and co
ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports
In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can
Unauthenticated remote code execution is possible against ClickHouse Server under certain conditions, with a CVSS 4.0 sc
Authentication bypass in Trigger.dev self-hosted v4 deployments (npm trigger.dev <=4.5.5) allows unauthenticated attacke
ClickHouse is an open-source column-oriented database management system. Rated medium severity (CVSS 4.9), this vulnerab
SQL injection in the SigNoz v5 query_range API (versions 0.87.0 through 0.141.x) lets authenticated users with the Viewe
Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3. Rated
ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports i
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports
GitHub PoC
Exploit-DB