PT-2024-36724 · Pghoard · Pghoard

Jserran1 · Published 2024-12-17 · Updated 2024-12-18 · CVE-2024-56142

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pghoard versions prior to 2.2.2a

Description A vulnerability has been discovered in pghoard that could allow an attacker to acquire disk access with privileges equivalent to those of pghoard, allowing for unintended path traversal. Depending on the permissions or privileges assigned to pghoard, this could allow disclosure of sensitive information.

Recommendations To resolve the issue, users are advised to upgrade to a version after 2.2.2a. At the moment, there are no known workarounds for this vulnerability.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-56142

GHSA-M9HC-VXJJ-4X6Q

Affected Products

Pghoard

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56142.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-56142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56142 · Security Note
• https://osv.dev/vulnerability/GHSA-m9hc-vxjj-4x6q · Vendor Advisory
• https://github.com/Aiven-Open/pghoard/security/advisories/GHSA-m9hc-vxjj-4x6q · Note
• https://github.com/Aiven-Open/pghoard/commit/fe9947642cc73bcacf6d19b93eb98f442223fb47 · Note
• https://github.com/Aiven-Open/pghoard · Note
• https://twitter.com/CVEnew/status/1869138089769107786 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1869186508357296572 · Twitter Post
• https://t.me/cvedetector/13137 · Telegram Post
• https://t.me/cvenotify/104738 · Telegram Post