CVE-2024-45624

2024-09-1205:15:05

CWE-200

jpcert

web.nvd.nist.gov

pgpool-ii

sensitive information

incompatible policies

unauthorized access

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

Percentile

9.6%

JSON

Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized for the user may be retrieved.

Affected configurations

Vulners

Vulnrichment

Node

pgpool_global_development_grouppgpooladminMatch3.2

pgpool_global_development_grouppgpooladminMatch4.0

pgpool_global_development_grouppgpooladminMatch3.7

pgpool_global_development_grouppgpooladminMatch3.6

pgpool_global_development_grouppgpooladminMatch3.5

pgpool_global_development_grouppgpooladminMatch3.4

pgpool_global_development_grouppgpooladminMatch3.3

VendorProductVersionCPE
pgpool_global_development_grouppgpooladmin3.2cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.2:*:*:*:*:*:*:*
pgpool_global_development_grouppgpooladmin4.0cpe:2.3:a:pgpool_global_development_group:pgpooladmin:4.0:*:*:*:*:*:*:*
pgpool_global_development_grouppgpooladmin3.7cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.7:*:*:*:*:*:*:*
pgpool_global_development_grouppgpooladmin3.6cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.6:*:*:*:*:*:*:*
pgpool_global_development_grouppgpooladmin3.5cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.5:*:*:*:*:*:*:*
pgpool_global_development_grouppgpooladmin3.4cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.4:*:*:*:*:*:*:*
pgpool_global_development_grouppgpooladmin3.3cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pgpool_global_development_group	pgpooladmin	3.2	cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.2:::::::*
pgpool_global_development_group	pgpooladmin	4.0	cpe:2.3:a:pgpool_global_development_group:pgpooladmin:4.0:::::::*
pgpool_global_development_group	pgpooladmin	3.7	cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.7:::::::*
pgpool_global_development_group	pgpooladmin	3.6	cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.6:::::::*
pgpool_global_development_group	pgpooladmin	3.5	cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.5:::::::*
pgpool_global_development_group	pgpooladmin	3.4	cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.4:::::::*
pgpool_global_development_group	pgpooladmin	3.3	cpe:2.3:a:pgpool_global_development_group:pgpooladmin:3.3:::::::*

CNA Affected

[
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "All versions of 3.2 series",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "4.5.0 to 4.5.3 (4.5 series)",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "4.4.0 to 4.4.8 (4.4 series)",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "4.3.0 to 4.3.11 (4.3 series)",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "4.2.0 to 4.2.18 (4.2 series)",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "4.1.0 to 4.1.21 (4.1 series)",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "All versions of 4.0 series",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "All versions of 3.7 series",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "All versions of 3.6 series",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "All versions of 3.5 series",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "All versions of 3.4 series",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "PgPool Global Development Group",
    "product": "Pgpool-II",
    "versions": [
      {
        "version": "All versions of 3.3 series",
        "status": "affected"
      }
    ]
  }
]