Description

PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.

Remediation

References

CVE-2007-6600

Related Vulnerabilities

WordPress Plugin Google Doc Embedder Cross-Site Scripting (2.5.18)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-6588)

GibbonEdu Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-40214)

MyBB Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-2327)

WordPress Plugin GD Star Rating 'export.php' Security Bypass (1.9.18)

Severity

Medium

Classification

CVE-2007-6600 CWE-264

Tags

Missing Update Known Vulnerabilities