Description

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

References

CVE-2020-25696

Related Vulnerabilities

Joomla Use of Insufficiently Random Values Vulnerability (CVE-2012-1562)

Claroline Other Vulnerability (CVE-2006-1595)

Serendipity Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-5314)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-0724)

Elgg Exposure of Private Personal Information to an Unauthorized Actor Vulnerability (CVE-2021-3980)

Severity

High

Classification

CVE-2020-25696 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities