Description

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.

Remediation

References

CVE-2014-0060

Related Vulnerabilities

Rukovoditel Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-20166)

MySQL CVE-2015-0374 Vulnerability (CVE-2015-0374)

WordPress Plugin Events Manager Extended 'admin.php' SQL Injection (3.1.2)

Joomla Other Vulnerability (CVE-2006-6834)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-19217)

Severity

Medium

Classification

CVE-2014-0060 CWE-264

Tags

Missing Update Known Vulnerabilities