CVE-2022-26520: Undefined Security Weakness

In pgjdbc before 42.3.3, an attacker who controls the jdbc URL or properties can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat...

PT-2022-7464 · Apache +3 · Apache Tomcat +3

Name of the Vulnerable Software and Affected Versions: pgjdbc versions prior to 42.3.3 Description: The issue is related to the creation of arbitrary files through the loggerFile and loggerLevel connection properties in the pgjdbc driver. An attacker who controls the jdbc URL or properties can ca...