[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2014-0060Date: (C)2014-05-20   (M)2023-12-22


PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 4.0
Exploit Score: 8.0
Impact Score: 2.9
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality: NONE
Integrity: PARTIAL
Availability: NONE
  
Reference:
SECUNIA-61307
APPLE-SA-2014-10-16-3
DSA-2864
DSA-2865
RHSA-2014:0211
RHSA-2014:0221
RHSA-2014:0249
RHSA-2014:0469
USN-2120-1
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://support.apple.com/kb/HT6448
http://wiki.postgresql.org/wiki/20140220securityrelease
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.postgresql.org/about/news/1506/
https://puppet.com/security/cve/cve-2014-0060
https://support.apple.com/kb/HT6536
openSUSE-SU-2014:0345
openSUSE-SU-2014:0368

CPE    57
cpe:/a:postgresql:postgresql:8.4.7
cpe:/a:postgresql:postgresql:8.4.6
cpe:/a:postgresql:postgresql:8.4.9
cpe:/a:postgresql:postgresql:8.4.8
...
CWE    1
CWE-264
OVAL    13
oval:org.secpod.oval:def:1600166
oval:org.secpod.oval:def:203041
oval:org.secpod.oval:def:203046
oval:org.secpod.oval:def:33748
...

© SecPod Technologies