Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-2625

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

Published

2022-08-18T19:15:14.500

Last Modified

2024-11-21T07:01:23.017

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.0 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-915
  • Type: Primary
    CWE-1321
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application postgresql postgresql < 10.22 Yes
Application postgresql postgresql < 11.17 Yes
Application postgresql postgresql < 12.12 Yes
Application postgresql postgresql < 13.8 Yes
Application postgresql postgresql < 14.5 Yes
Application postgresql postgresql 15 Yes
Application postgresql postgresql 15 Yes
Operating System fedoraproject fedora 36 Yes
Operating System redhat enterprise_linux 6.0 Yes
Operating System redhat enterprise_linux 7.0 Yes
Operating System redhat enterprise_linux 8.0 Yes
Operating System redhat enterprise_linux 9.0 Yes
References