Information Disclosure Vulnerability in Pgpool-II Database Connection Pooling Software
CVE-2023-22332
Key Information:
- Status
- Vendor
- CVE Published:
- 30 January 2023
What is CVE-2023-22332?
An information disclosure vulnerability exists in Pgpool-II that allows unauthorized database users to obtain sensitive authentication credentials from other database users. This issue affects multiple versions across the 4.x and 3.x series. By exploiting this vulnerability, a remote attacker who gains access through the compromised credentials could alter stored data, potentially leading to suspension of database services or unauthorized modifications, thus jeopardizing the integrity and confidentiality of the database.
Affected Version(s)
Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series