Description

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.

Remediation

References

CVE-2009-3230

Related Vulnerabilities

PHP CVE-2004-1063 Vulnerability (CVE-2004-1063)

Apache httpd remote denial of service

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-11612)

WordPress Plugin Video Downloader for TikTok Directory Traversal (1.3)

Oracle JRE CVE-2013-2449 Vulnerability (CVE-2013-2449)

Severity

Medium

Classification

CVE-2009-3230 CWE-264

Tags

Missing Update Known Vulnerabilities