Intel Neural Compressor (SQL injection): SQL injection reachable by an authenticated user of Neural Compressor

Impact

SQL injection reachable by an authenticated user of Neural Compressor. Gets an attacker the backing database of the optimisation service - job metadata, model references, and whatever credentials the deployment stored there.

Who can reach it

Any authenticated user of the Neural Compressor service.

What to do

Upgrade to Neural Compressor v3.0 or later. Application-level update, restart the service.

References