GitHub Advisoryadvisory · RubyGems

GHSA-vf99-xw26-86g5 PgHero Allows Information Disclosure Through EXPLAIN Feature

HIGH Published 2023-01-05 Modified 2023-01-11 Official page ↗
Aliases
CVE-2023-22626
Ecosystem
RubyGems
Packages
pghero
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-209
Reviewed
2023-01-09

Affected packages

• RubyGems pghero: < 3.1.0 → fixed in 3.1.0

Description

PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server.)

Related

Alias · CVE (1)

  • CVE-2023-22626 PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References