Description

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

Remediation

References

CVE-2018-16850

Related Vulnerabilities

Dot CMS Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-12872)

Oracle JRE CVE-2014-0457 Vulnerability (CVE-2014-0457)

WordPress Plugin Login No Captcha reCAPTCHA Security Bypass (1.6.11)

WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress Insecure Direct Object Reference (1.0.30)

WordPress Plugin WP Forum Server Cross-Site Scripting and SQL Injection Vulnerabilities (1.7.3)

Severity

Critical

Classification

CVE-2018-16850 CWE-138 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities