Description

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.

Remediation

References

CVE-2009-3230

Related Vulnerabilities

WordPress Plugin Appointments Cross-Site Scripting (2.2.2.2)

WordPress Plugin Showbiz Pro Responsive Teaser Arbitrary File Upload (1.7.1)

WordPress Plugin GiveWP-Donation and Fundraising Platform Multiple Cross-Site Scripting Vulnerabilities (2.17.2)

Apache HTTP Server Numeric Errors Vulnerability (CVE-2003-1580)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-18098)

Severity

Medium

Classification

CVE-2009-3230 CWE-264

Tags

Missing Update Known Vulnerabilities