SQL Command Injection Vulnerability in PostgreSQL Database
CVE-2020-14349

7.1HIGH

Key Information:

Vendor
Postgresql
Status
Postgresql
Vendor
CVE Published:
24 August 2020

Summary

A vulnerability exists in PostgreSQL that could allow an authenticated attacker to manipulate the search_path during logical replication in order to execute arbitrary SQL commands within the replication user's context. This flaw emphasizes the importance of proper sanitization in database operations to protect against potential unauthorized actions.

Affected Version(s)

PostgreSQL PostgreSQL versions before 12.4, before 11.9 and before 10.14

References

http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisoryx_refsource_SUSE

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.