PT-2022-25516 · Actian · Actian Zen Psql

Published 2022-09-30 · Updated 2025-05-20 · CVE-2022-40756

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Actian Zen PSQL versions prior to v15.11.005 Actian Zen PSQL versions prior to v15.01.017 Actian Zen PSQL versions prior to v14.21.022

Description The issue arises when folder security is misconfigured, allowing an attacker with file read/write access to remove specific security files. This can lead to the master password being reset, resulting in unauthorized access to the database.

Recommendations For versions prior to v15.11.005, apply Patch Update 1 for Zen 15 SP1. For versions prior to v15.01.017, apply Patch Update 4 for Zen 15. For versions prior to v14.21.022, apply Patch Update 5 for Zen 14 SP2.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-40756

Affected Products

Actian Zen Psql

References · 6

• https://actian.com/support-services · Vendor Advisory
• https://actian.my.salesforce.com/sfc/p/#300000001XnW/a/4y000000LhjZ/s7Hk0dFM1Z9nLuAPa50rMaZie7mqCR5u33NZFbdKT7Q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-40756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40756 · Security Note
• https://t.me/cibsecurity/50801 · Telegram Post
• https://t.me/cvenotify/123068 · Telegram Post