PT-2023-10828 · Blue Yonder · Postgraas Server

Published 2023-07-18 · Updated 2024-05-17 · CVE-2018-25088

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blue Yonder postgraas server versions up to 2.0.0b2

Description A critical issue was found in the PostgreSQL Backend Handler component, specifically in the create pg connection/create postgres db function of the postgraas server/backends/postgres cluster/postgres cluster driver.py file. This issue leads to sql injection.

Recommendations To address this issue, upgrade to version 2.0.0. As a temporary workaround, consider restricting access to the vulnerable postgraas server component to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-25088

GHSA-VGHM-8CJP-HJW6

Affected Products

Postgraas Server

References · 9

• https://github.com/blue-yonder/postgraas_server/releases/tag/v2.0.0 · Patch
• https://github.com/blue-yonder/postgraas_server/commit/7cd8d016edc74a78af0d81c948bfafbcc93c937c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-25088 · Security Note
• https://osv.dev/vulnerability/CVE-2018-25088 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vghm-8cjp-hjw6 · Vendor Advisory
• https://github.com/blue-yonder/postgraas_server · Note
• https://t.me/cibsecurity/66889 · Telegram Post
• https://vuldb.com/?ctiid.234246 · Note
• https://vuldb.com/?id.234246 · Note