SB2018081310 - Multiple vulnerabilities in PostgreSQL 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018081310

SB2018081310 - Multiple vulnerabilities in PostgreSQL

Published: August 13, 2018

Security Bulletin ID SB2018081310
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) SQL injection (CVE-ID: CVE-2018-10915)

The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in web application database.

Successful exploitation of the vulnerability may allow an attacker to gain administrative access to vulnerable web application.


2) Information disclosure (CVE-ID: CVE-2018-10925)

The vulnerability allows a remote privileged attacker to obtain potentially sensitive information.

The vulnerability exists due to improper check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". A remote attacker with "CREATE TABLE" privileges can read arbitrary bytes server memory.


Remediation

Install update from vendor's website.

References