File Manipulation Vulnerability in pgjdbc Driver Affecting Applications

CVE-2022-26520

Summary

A vulnerability exists in the pgjdbc JDBC driver prior to version 42.3.3 that allows an attacker with control over the JDBC URL or properties to exploit the loggerFile and loggerLevel connection properties. This can result in the ability to write arbitrary files to the system, including creating executable JSP files within a Tomcat web root. While the vendor asserts that the risk lies with any application using the pgjdbc driver with untrusted connection properties, it highlights the importance of securing application configurations to prevent unauthorized file access and execution.

References