CVE-2022-2625
High
Description
A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.
SeverityHigh
CVSS8.0
Exploit probability—
Product
Postgresql
PublishedAug 18, 2022
First seenAug 18, 2022
Weakness typeCWE-915CWE-915
How to fix
Update
- postgresql postgresql10.22, 11.17, 12.12, 13.8, 14.5 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postgresql postgresql | 10.0 ≤ v < 10.22, 11.0 ≤ v < 11.17, 12.0 ≤ v < 12.12, 13.0 ≤ v < 13.8, 14.0 ≤ v < 14.5, 15 | 10.22, 11.17, 12.12, 13.8, 14.5 |
| fedoraproject fedora | 36 | — |
| redhat enterprise_linux | 6.0, 7.0, 8.0, 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.