Unsuccessful Retrieval of Sensitive Information Due to Incompatible Policies
CVE-2024-45624

7.5HIGH

Key Information:

Vendor

Pgpool Global Development Group

Status
Pgpool-ii
Vendor
CVE Published:
12 September 2024

What is CVE-2024-45624?

An issue within Pgpool-II allows unauthorized access to sensitive data. When a database user interacts with a query cache, there is a risk of retrieving table data that they should not have access to, due to incompatible policy settings. This vulnerability underscores the importance of properly configuring access controls to safeguard sensitive information stored within the database.

Affected Version(s)

Pgpool-II All versions of 3.2 series

Pgpool-II 4.5.0 to 4.5.3 (4.5 series)

Pgpool-II 4.4.0 to 4.4.8 (4.4 series)

References

https://www.pgpool.net/mediawiki/index.php/Main_Page#News
https://jvn.jp/en/jp/JVN67456481/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.