PT-2022-4131 · Unknown+11 · Postgresql+10
Sven Klemm
·
Published
2022-08-10
·
Updated
2026-01-30
·
CVE-2022-2625
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
PostgreSQL (affected versions not specified)
Description
A vulnerability was found in PostgreSQL that allows an attacker to run arbitrary code as the victim role, which may be a superuser. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. The flaw is related to errors when using OR commands with extensions, which can allow a remote attacker to elevate their privileges and replace arbitrary objects in the database.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Postgresql
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu