CVE-2018-1115

2018-05-1019:00:00

CWE-732

redhat

www.cve.org

CVSS3

4.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

8.9

Confidence

High

EPSS

0.007

Percentile

80.7%

JSON

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn’t follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.

CNA Affected

[
  {
    "product": "postgresql",
    "vendor": "unspecified",
    "versions": [
      {
        "status": "affected",
        "version": "postegresql 10.4"
      },
      {
        "status": "affected",
        "version": " postegresql 9.6.9"
      }
    ]
  }
]