Lucene search

20be33e2-bf35-4d13-8fad-18bd2f3e3659NVD:CVE-2024-4545

HistoryMay 14, 2024 - 3:44 p.m.

CVE-2024-4545

2024-05-1415:44:02

CWE-269

20be33e2-bf35-4d13-8fad-18bd2f3e3659

web.nvd.nist.gov

cve-2024-4545

enterprisedb

postgres

advanced server

role permissions

bypass

low privilege users

file read

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

Percentile

15.5%

JSON

All versions of EnterpriseDB Postgres Advanced Server (EPAS) from 15.0 prior to 15.7.0 and from 16.0 prior to 16.3.0 may allow users using edbldr to bypass role permissions from pg_read_server_files. This could allow low privilege users to read files to which they would not otherwise have access.

References

www.enterprisedb.com/docs/epas/15/epas_rel_notes/

www.enterprisedb.com/docs/epas/latest/epas_rel_notes/

www.enterprisedb.com/docs/security/advisories/cve20244545/

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for NVD:CVE-2024-4545