Permissions, Privileges, and Access Controls in PostgreSQL - CVE-2012-3488

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32769

Permissions, Privileges, and Access Controls in PostgreSQL - CVE-2012-3488

Published: October 4, 2012 / Updated: July 28, 2020


Vulnerability identifier: #VU32769
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2012-3488
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: PostgreSQL Global Development Group
Affected software:
PostgreSQL

Detailed vulnerability description

The vulnerability allows a remote #AU# to read and manipulate data.

The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.


How to mitigate CVE-2012-3488

Install update from vendor's website.

Sources