Lucene search

[email protected]CVE-2018-1058

HistoryMar 02, 2018 - 3:29 p.m.

CVE-2018-1058

2018-03-0215:29:00

CWE-20

[email protected]

web.nvd.nist.gov

295

postgresql

cve-2018-1058

database security

code execution

user query

superuser permissions

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.9%

JSON

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

Affected configurations

Vulners

NVD

Node

the_postgresql_global_development_grouppostgresqlRange≤9.3

CPENameOperatorVersion
postgresql:postgresqlpostgresqllt9.3.22
postgresql:postgresqlpostgresqllt9.4.17
postgresql:postgresqlpostgresqllt9.5.12
postgresql:postgresqlpostgresqllt9.6.8
postgresql:postgresqlpostgresqllt10.3

CPE	Name	Operator	Version
postgresql:postgresql	postgresql	lt	9.3.22
postgresql:postgresql	postgresql	lt	9.4.17
postgresql:postgresql	postgresql	lt	9.5.12
postgresql:postgresql	postgresql	lt	9.6.8
postgresql:postgresql	postgresql	lt	10.3

CNA Affected

[
  {
    "product": "postgresql",
    "vendor": "The PostgreSQL Global Development Group",
    "versions": [
      {
        "status": "affected",
        "version": "9.3 - 10"
      }
    ]
  }
]