CVEvulnerability

CVE-2020-1720

6.5 MEDIUM Published 2020-03-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-03-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.1 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-285, CWE-862

Description

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

Affected configurations

• postgresql postgresql (>= 9.6 < 9.6.17) • postgresql postgresql (>= 10.0 < 10.12) • postgresql postgresql (>= 11.0 < 11.7) • postgresql postgresql (>= 12.0 < 12.2) • redhat decision manager 7.0 • redhat software collections • redhat enterprise linux 8.0

Related

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-862 Missing Authorization weakness

References