Ubuntu.comUB:CVE-2022-26520CVE-2022-26520
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.002 Low
EPSS
Percentile
55.1%
DISPUTED In pgjdbc before 42.3.3, an attacker (who controls the jdbc
URL or properties) can call java.util.logging.FileHandler to write to
arbitrary files through the loggerFile and loggerLevel connection
properties. An example situation is that an attacker could create an
executable JSP file under a Tomcat web root. NOTE: the vendor’s position is
that there is no pgjdbc vulnerability; instead, it is a vulnerability for
any application to use the pgjdbc driver with untrusted connection
properties.
References
github.com/pgjdbc/pgjdbc/commit/f6d47034a4ce292e1a659fa00963f6f713117064 (REL42.3.3-rc1)
github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8
launchpad.net/bugs/cve/CVE-2022-26520
nvd.nist.gov/vuln/detail/CVE-2022-26520
security-tracker.debian.org/tracker/CVE-2022-26520
www.cve.org/CVERecord?id=CVE-2022-26520
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.002 Low
EPSS
Percentile
55.1%