Published: 10/03/2022 Updated: 11/04/2024

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

In pgjdbc prior to 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties

Vulnerable Product	Search on Vulmon	Subscribe to Product
postgresql postgresql jdbc driver
debian debian linux 10.0
debian debian linux 11.0

Several security vulnerabilities have been found in libpgjava, the official PostgreSQL JDBC Driver CVE-2020-13692 An XML External Entity (XXE) weakness was found in PostgreSQL JDBC CVE-2022-21724 The JDBC driver did not verify if certain classes implemented the expected interface before instantiating the class This can lead to code ...

Synopsis Important: Service Registry (container images) release and security update [230GA] Type/Severity Security Advisory: Important Topic An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog The purpose of this text-only errata is to inform you about the security issues fi ...

Synopsis Important: Red Hat Process Automation Manager 7131 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Process Automation ManagerRed Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base score, which gives ...

Synopsis Important: Red Hat Fuse 7110 release and security update Type/Severity Security Advisory: Important Topic A minor version update (from 710 to 711) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this update ...

NVD-CWE-noinfo https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8 https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3 https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc https://jdbc.postgresql.org/documentation/head/tomcat.html https://www.debian.org/security/2022/dsa-5196 https://www.debian.org/security/2022/dsa-5196 https://nvd.nist.gov

CVE-2022-26520

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect